Top management should formally review the PAPMS at planned intervals for continuing suitability, adequacy and effectiveness, looking at opportunities to improve and needed changes to policy, scope, objectives and targets, and keep records of every review. Inputs should include: PAPMS audit and routine review results; feedback from internal and external stakeholders; exercise and test results; the degree to which objectives and targets were achieved; status of corrective and preventive actions; follow-up from earlier reviews; changes in internal, external and risk management context; changing circumstances, such as new or changed legal, regulatory and other requirements; and chances to improve. Outputs should include decisions and actions on whether to change the policy, the scope, the objectives and targets or any other element, aimed at improvement. The organization should communicate review outputs to relevant stakeholders, act on them and keep documented evidence of results.
This control maps to 3 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.