Risk management runs through the project phase as a supporting process: the initial risk assessment establishes whether GxP regulation applies and how great the overall impact is, further assessments follow as the specification and design develop where the category and novelty require them, and the results scale specification, design review, code review, testing and the operational controls. Risk-based decisions are documented, risk records are kept in a form that can be reused at change control and periodic review, and the process follows the five-step method described in chapter 5 and Appendix M3.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.