Consultants and contractors who provide I&T skills are aware of the organisation's policies and follow them, and they satisfy the contractual requirements agreed with them. Policies and procedures for contract staff are put in place. When they start, contractors formally agree to follow the I&T control framework (security clearance, physical and logical access, use of assets, confidentiality of information, non-disclosure), and they are told that management may monitor and inspect any use of IT resources, email, voice and files included. Contracts set out their roles and responsibilities and state explicitly that work must be documented to agreed standards. Their work is reviewed and payment is approved according to results. All work done by outside parties is set out in formal contracts that leave no ambiguity. Periodic reviews confirm that agreements have been signed and that roles and access rights are still appropriate.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.