Key roles for the system are identified and filled by individuals with sufficient experience and training: the process owner, who owns the business process and is accountable for the system being compliant and fit for the use intended, its plan and its approvals; the system owner, responsible for the availability, support and upkeep of the system and for keeping the data held on it secure; the quality unit, which approves key documentation and changes that could affect patients, product quality or the integrity of data, audits, and may be divided between corporate quality and operational quality, with delegated operational quality activities defined and independence demonstrated; subject matter experts, who lead verification within their expertise; the supplier, who provides documentation, expertise, testing and support; and end users, who contribute requirements, evaluate prototypes, test, accept and report defects. Specific activities may be delegated but responsibility is retained.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.