V-Model Lifecycle - specification phases mirrored by verification phases. SPECIFICATION SIDE: (a) USER REQUIREMENTS SPECIFICATION (URS) - what the business needs the system to do + GxP requirements + regulatory + audit + user-defined functional + non-functional; (b) FUNCTIONAL SPECIFICATION (FS) - what the system does to meet URS; (c) DESIGN SPECIFICATION (DS) - how the system is designed + architecture + data flows + interfaces. VERIFICATION SIDE: (a) INSTALLATION QUALIFICATION (IQ) - verifies system installed per design; (b) OPERATIONAL QUALIFICATION (OQ) - verifies system operates per functional specification under simulated operating conditions; (c) PERFORMANCE QUALIFICATION (PQ) - verifies system performs per URS under actual operating conditions including throughput + reliability + business processes; (d) USER ACCEPTANCE TESTING (UAT) overlapping PQ. TRACEABILITY MATRIX: links URS requirements to FS/DS + test cases + test results + ensures coverage + supports inspection + change-impact analysis. RISK-PROPORTIONATE: high-risk requirements receive more verification depth + redundancy + independent verification; low-risk requirements may receive lighter touch + sampling. RE-USE: across similar systems + leverage prior validation knowledge.
This control maps to 125 controls across 69 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 125 it maps to, and the evidence behind each claim, over MCP and REST.