The regulated company must make sure that its test strategy will show the system to be compliant and fit for intended use. How many tests, and of what kinds, depends on risk, complexity and novelty; the strategy takes into account what the supplier will do, including reuse of documentation the supplier already has; test results are recorded against set acceptance criteria drawn from the specifications; and failures are logged, reviewed, documented and managed, in line with the practices of Appendix D5 and the efficiency approaches of chapter 8.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.