Every assessment receives a technical review of report content, findings, grading and the effectiveness of corrections and action plans, followed by a decision on status (conforming, nonconforming, suspended, withdrawn) recorded with the deciders' names and the date. The statement is issued within 28 days of the decision and is valid one year from the initial decision, in rolling one-year cycles; re-assessments are timed to allow renewal, cover the whole system and the period since the last visit, and meet initial assessment rules; if renewal comes after expiry a fresh 12-month statement runs from the new decision date.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.