For each supplier the relationship is formalised and managed; contracts and service delivery are managed, maintained and monitored; and new contracts, or changes to existing ones, are checked for consistency with enterprise standards and with legal and regulatory requirements. Relationship owners are appointed and held accountable for service quality. A formal process for communication and review fixes how and when the parties interact. Formal contracts are agreed, managed, maintained and renewed in line with standards and the law. Contracts with key service vendors allow management or independent third parties to review the vendor's site, practices and controls, and independent audit and assurance are agreed. Disputes go through set procedures once the relationship and communication routes have been tried. Roles and responsibilities are formalised for each vendor, and where several vendors jointly deliver one service a lead contractor role is considered. How effective the relationship is gets evaluated, and improvements are defined, communicated and agreed.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.