Testing offers the greatest opportunity for savings: supplier test results and results from other testing such as finance or HSE are reused rather than duplicated, with document requirements communicated to suppliers in advance; the level and type of testing, from normal, invalid, repeatability, performance, regression and structural testing, depends on risk and on what kind of component is involved, with user requirements verified by the regulated company through installation and acceptance testing and other testing decided by a documented and justified review of existing evidence approved by a subject matter expert including the quality unit for critical aspects; secondary evidence such as screenshots is generated only where it adds value, for complex, visual or before-and-after results, with test evidence retained electronically where secure and sufficient for objective review; and test witnesses are not required, with any decision to use them considering tester knowledge, the level of expert review and the degree of automation, and it being disproportionate to have testers initial every step.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.