Processes, products and services obtained from outside must meet requirements. Under 9100 the organization is responsible for their conformity, including those from sources the customer specifies; it must use external providers and process sources (such as special processes) that the customer has designated or approved where required; it must identify and manage the risks of external provision and of choosing and using providers; and it must require its providers to apply suitable controls over their own direct and lower-tier providers. The organization sets controls where bought-in products become part of its own, go straight to the customer, or where a process is outsourced. It sets and applies criteria for assessing, choosing, monitoring and re-assessing providers, keeping records, and treats external quality data such as accredited certification as only one input. 9100 also requires the organization to: set out the process, responsibility and authority for deciding approval status and for controlling use according to that status; keep a register of external providers showing approval status and scope; review provider performance periodically, conformity and on-time delivery included; decide what to do about providers that fall short; and set the controls over records providers create or keep.
This control maps to 4 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 4 it maps to, and the evidence behind each claim, over MCP and REST.