Functions run by a head office (purchasing, supplier approval, quality assurance and similar) are assessed, including interviews with the people who hold that authority, documented, done before the site assessments and separately if the head office is not a site; each site then gets its own assessment, report and statement within three months, confirms head office rules are adopted locally, and its statement names the central processes assessed (the head office gets no statement of its own). Off-site stores of the same legal entity and food safety system used only for the site's product are covered in the same assessment, listed by location and activity, with findings identifiable per location.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.