Specification and verification is the general model: the system is specified to a level of detail that matches its risk, complexity and novelty, and verification demonstrates that each specification has been met, using whatever combination of review, inspection and testing is appropriate. Specifications range from a requirements specification only, for a low-risk standard product, to layered requirements, functional, configuration and design specifications for a custom application, and verification covers requirements, configuration, design and code as required, with traceability between specification and verification maintained. Terminology is not prescribed: the guide accepts installation and operational qualification or verification and commissioning language as long as the activities and evidence are equivalent.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.