The organization must maintain procedures for actual and potential nonconformities and for corrective and preventive action that identify and correct nonconformities and mitigate their impacts, investigate causes and act to prevent recurrence, evaluate and implement preventive actions, record results and review their effectiveness, with the action taken scaled to the possible impact and carried out quickly; it must identify changed risks and focus preventive action on significantly changed risks, prioritised by the risk assessment and impact analysis, and update the system documentation.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.