As part of quality planning, suppliers carry out a formal assessment of their own sub-suppliers and repeat it at intervals set by the QMS. Whether to audit a sub-supplier is decided on the basis of a risk assessment and the decision is recorded. Where a sub-supplier affects where GxP regulated data is located or hosted, how it is managed can bear directly on the regulated company's compliance, and so it should be visible to the regulated company.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.