The specifications needed to define the system are decided during planning: customer-specific functional specifications describe the detailed functions the system will perform and are reviewed and approved by the regulated company for custom applications and configured products, often as a contractual document; configuration specifications define the required configuration of the software packages and are reviewed and approved with the information accessible to the regulated company; design specifications for custom systems contain enough detail to build and maintain the system and are reviewed and accepted by technical subject matter experts; and a current system description is available for inspection and training. Design reviews evaluate the deliverables against standards and requirements at suitable stages, performed by subject matter experts, not typically required for standard products, focused on configuration and customization for configured products, and conducted at various levels for complex custom applications, with supplier development reviews verified during supplier assessment.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.