Design reviews are planned, systematic evaluations of specifications, design and development deliverables against standards and requirements, performed by identified subject matter experts at appropriate points, with rigor and records based on risk, complexity and novelty, planned for scope and objectives, method, participants and outputs; tools such as code analysis and traceability tools can perform aspects of review; regulated company design review is typically not required for standard products, focuses on configuration and implementation for configured products with the supplier's development reviews verified at supplier assessment, and is conducted at each level of specification or within each sprint for custom applications. Traceability establishes the relationship between products of the development process so that requirements trace to configuration or design elements and to the verification that shows they are met, supports risk management, change impact, regression scope and inspection response, and depends on complete and accurate specifications; the method is chosen at planning based on risk and complexity, with automated tools strongly recommended over spreadsheets and matrices, common numbering across requirements, design and tests sufficient for simple systems, traceability between requirements and verification sufficient for standard products, links to configuration items for configured products, full traceability through each specification level for custom applications, and Agile tools providing inherent traceability from backlog to release once verified at tool selection. Traceability may add requirement descriptions, change control references, criticality, procedural controls with their procedure references and the level, timing and location of testing, may rely on supplier traceability verified at assessment, and requires early planning for global systems.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.