Group regulatory expectations into a small set of stable control families and types, then run your program around those, not around clauses, articles and acronyms.
This is not the first time the head of the Office of Management and Budget has pushed back against Congress’ watchdog.