During the project phase each controlled item that is reviewed, approved or tested is governed by configuration management and subject to change management from its first formal approval, with the level of formality varying by item and growing as the project advances, the point of transfer to operational change management defined before handover, and project scope changes handled by project management processes. Configuration management consists of configuration identification, control, status accounting and evaluation, begins as early as possible, may need a separate plan for large projects, and benefits from automated tools whose selection and use are documented and risk-based. Controlled items include supplier contracts and assessments, requirements and design specifications, review documents, risk assessments, test specifications, results and discrepancy records, reports, hardware, developed code, third-party software, configuration files and manuals. Formal control is not introduced so early that iterative development is stifled: drafts stay under version control without change control, prototyping changes are exempt until they become design proposals, and code is managed in automated tools with check-in and check-out. Any project member can raise a uniquely identified change, each change is reviewed with a risk assessment and accepted or rejected, the scope, affected items, impact, further risk assessment, verification, risks and back-out plans are defined and recorded, traceability keeps requirement changes and their verification transparent, authority for acceptance is defined, items approved by the regulated company such as requirements, contracts and accepted software are changed only after prior approval, the quality unit approves changes to regulatory and compliance requirements, complex changes may need a change plan, and completed changes are verified, approved by the project manager and closed.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.