Before telling external providers what is required, the organization makes sure the requirements are adequate. Providers are told: the processes, products and services they are to supply, with the relevant technical data; how approval will be given for products and services, for methods, processes and equipment, and for release; the competence and qualifications required; how the two parties will interact; how their performance will be monitored; any verification or validation the organization or its customer will carry out at the provider's premises; and, under 9100: control of design and development; special requirements; critical items, key characteristics among them; testing, inspection and verification, verification of the production process included; statistical techniques for accepting product; and the need to operate a QMS, use sources the customer has designated or approved (special process sources included), report nonconformities and get the disposition approved, prevent counterfeit parts, report and obtain approval for changes to processes, products, services, providers or the site of manufacture, pass relevant requirements, customer ones included, down their own supply chain, supply test specimens, and keep records with stated retention periods and disposal arrangements. Also communicated are the right of the organization, its customer and regulators to enter facilities and see records at every tier of the supply chain, and the need for the provider's people to understand how they contribute to conformity and product safety and why ethical behaviour matters.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.