Suppliers and service providers of computerized systems and services are assessed for their quality capability, the reliance placed on them is decided on that basis, their responsibilities and the regulated company's expectations are defined in contracts, quality agreements or service level agreements, and their performance and continued suitability are monitored and periodically re-evaluated. The regulated company leverages supplier knowledge, documentation and testing where the assessment supports it, retains accountability for compliance, and manages the relationship so that changes, incidents, support, data location and exit are handled in a controlled way.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.