The three-year cycle is kept; stage 1 and stage 2 follow ISO/IEC 17021-1 with no more than six months between them (otherwise stage 1 is repeated); surveillance happens every calendar year, the first within 12 months of the decision or the certificate is suspended; each on-site surveillance covers all PAS 24000 Annex A requirements, the Part 2 additional requirements, internal audit and management review, action on earlier findings, complaints, effectiveness against objectives, improvement progress, operational control, changes, interviews and file reviews and a site tour, with the full scheme covered across the two surveillances; recertification is a full audit completed before expiry. Audits run on consecutive working days at the premises, in an agreed language, with the client flagging local holidays and shutdowns.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.