Findings are graded minor, major or critical, written against the most relevant requirement and not grouped unless systemic; head office findings are treated as affecting every site and cleared before site statements issue; opportunities for improvement are not allowed. For a minor, the client submits correction evidence, cause investigation and an action plan, which the CAB approves within 28 days of the assessment or the statement is suspended (or an initial assessment repeated), with effectiveness checked at the next visit. For a major, the client provides cause investigation and evidence of implementation and the CAB closes it within 28 days, by follow-up visit or desk review, with temporary controls evidenced if the permanent fix takes longer, or suspends. For a critical, the statement is suspended within three working days for up to six months, the client submits cause analysis and an action plan within 14 days, a full on-site follow-up of at least a day is held between six weeks and six months later, and the statement is withdrawn if the critical is not resolved in time; initial assessments are repeated.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.