# 13. How should a GRC platform distinguish a binding obligation from guidance, a proposal or an internal policy?

**A good answer should begin with legal-entity applicability, authoritative source and status—not a framework-count claim.** Ask how a change becomes an accountable business decision.

**Why it matters to buyers.** Current examples show why status and dates belong in the data model:

| Area | Verified status relevant to the interview | Proposed buyer test |
|---|---|---|
| US banking third-party risk | On **11 September 2026**, the agencies requested comment on proposed replacement guidance. The announcement describes supervisory guidance as non-binding and says existing guidance would be replaced when the new guidance is finalised. Do not present the proposal as a final rule. ([federalreserve.gov](https://www.federalreserve.gov/newsevents/pressreleases/bcreg20260911a.htm)) | Keep the proposal separate from the approved current methodology; record assessment and implementation decisions. |
| HIPAA Security Rule | HHS identifies the cybersecurity update as a proposal and states that the existing Security Rule remains in effect during rulemaking. The 2026 Unified Agenda lists the initiative under Long-Term Actions. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html)) | Track proposed changes without marking them as newly effective obligations. |
| NYDFS Part 500 | The published covered-entity implementation timeline placed the specified MFA and asset-inventory provisions at **1 November 2025**—a past date, not an upcoming 2026 milestone. Applicability and exemptions still require review. ([dfs.ny.gov](https://www.dfs.ny.gov/system/files/documents/2023/11/cybersecurity_implementation_timeline_covered_entities.pdf?utm_source=openai)) | Apply the correct entity scope, effective date and approved exception treatment. |

**Put it to:** Carole Switzer and a qualified sector regulatory specialist; have the buyer’s counsel confirm applicability.

**A strong answer should cover:** source version, publication and effective dates, legal entity, applicability rationale, mapping owner, review status, implementation decision and historical reporting.

**Ask for proof:** change one obligation and show which policies, controls, evidence requests and owners are affected—without overwriting the previous interpretation.

**Follow-up:** “Who is accountable if the content feed is current but our applicability decision or control mapping is wrong?”

> **Expert quote — pending interview:** [Insert approved quotation and attribution.]