The provider keeps an up-to-date written list of every worker in a risk assessed role with: full name, date of birth and address; the risk assessed roles they fill; for a worker allowed to work without a clearance, the exception relied on, its start and end dates and the supervisor's name; and for a worker who needs a clearance, the application number, the clearance number, the outcome and expiry, and whether any decision to suspend or revoke, or other decision stopping the provider from allowing the work, applies and its nature.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.