The enterprise sets up and maintains a quality management system that provides a standard, formal and ongoing way of managing the quality of information, so that its enabling technology and its business processes stay in line with business requirements and with how the enterprise manages quality. That approach is built into the I&T control framework and into business and IT processes, with quality management processes, standards and practices defined. The organisational structure defines, for managing quality, who holds which roles, tasks, responsibilities and decision rights. Management and stakeholders inside and outside the enterprise help define quality requirements and criteria. The system is monitored and reviewed regularly against agreed acceptance criteria, including feedback from customers, users and management, and discrepancies that reviews uncover drive continuous improvement.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.