Outputs that fail to conform are identified and controlled so they are not used or delivered by mistake; this covers nonconforming product made in-house, received from an external provider or found by a customer, and action matches the kind of nonconformity and what it affects, including where it is found after delivery. Under 9100, the process for controlling nonconformities is kept as documented information and sets out: who is responsible for, and authorized to, review and decide on nonconforming output, and how the people who make those decisions are approved; containment of any effect on other processes, products or services; prompt notification of the customer and relevant interested parties about nonconformities affecting products already delivered; and corrective actions for nonconformities found after delivery. The options are correction; segregation, containment, return or suspension; telling the customer; and acceptance under concession, authorized by a relevant authority and, where applicable, the customer as well. Under 9100, a decision to repair or to use as is may be carried out only once approved by someone authorized to represent the design organization or holding delegated design authority, and, where the nonconformity departs from contract requirements, once the customer has authorized it. Scrapped product is marked clearly and permanently, or kept under positive control until it can no longer be used; counterfeit and suspected counterfeit parts are controlled so they cannot find their way back into the supply chain; corrected outputs are verified again; and records describe the nonconformity, what was done, any concessions granted and who decided.
This control maps to 3 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.