The enterprise periodically reviews each vendor's overall performance, its compliance with contract requirements and whether it gives value for money, and deals with any issues found. Where needed it asks for independent reviews of the vendor's internal practices and controls. Performance monitoring criteria consistent with service level agreements are defined and documented, and the vendor reports against them regularly and openly. Service delivery is monitored to confirm acceptable quality and compliance with requirements and contract conditions. Performance and value for money are compared with other vendors and with market conditions. Publicly available information about the vendor and its supply chain is watched. Review results are recorded, assessed and discussed with the vendor to find improvements.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.