Findings are graded minor, major or critical against the most relevant PAS 24000 or additional requirement; head office findings are treated as affecting all sites; opportunities for improvement are not permitted. Minor: correction evidence, cause analysis and action plan approved within 28 days or the certificate is suspended (at stage 2, the stage 2 is repeated within six months), with effectiveness checked next audit. Major (capability or legality affected): implementation evidence verified on site or by desk review and closed within 28 days or the certificate is suspended; where the permanent fix takes longer, interim controls are evidenced within 28 days and the permanent action verified within six months, otherwise a stage 2 is repeated in full.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.