The five-step process is: step 1, carry out the initial risk assessment and establish the system's impact, including whether the system is GxP regulated; step 2, find the functions that affect patients, product quality or the integrity of data; step 3, assess the risk of those functions and decide on controls; step 4 implement and verify the appropriate controls; and step 5 review the risks and monitor the controls during operation. The process is scalable, later steps build on earlier outputs, it may be applied during operation such as at change control using steps 2 to 5 with the original step 1 information, and the depth of each step depends on the category, impact and novelty of the system.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.