A procedure governs the management of the information that demonstrates a system is in a state of control, whether in documents or as records in tools, covering production, review, approval where appropriate, issue, withdrawal and storage, with the emphasis that information need not exist on paper, may live its whole life in a tool, must be searchable, and should not be created merely in case of inspection; supplier information standards are agreed at planning and the supplier's approach may be assessed. Production follows agreed standards for tools and searchability, and for written documents for layout, style, numbering and version control with drafts distinguished from approved versions, while information in tools has data integrity controls, restricted access, audit trails and change control by risk, and metadata for indexing. Review is by the appropriate subject matter expert with formality by risk, remediation completed before approval and actions logged to closure; approval takes any suitable form with the reason for each approval defined and dated, and rarely more than two approvals justified; issue completes indexing so information can be found, superseded versions are removed, marked and archived where needed, and controlled copies are managed; changes are controlled by risk with indexing and history updated and approved by the original functions; withdrawal follows a defined procedure with index, history and copy holders updated; and storage is safe and secure with data integrity protection, retrievability for the retention period and safeguards against use of unapproved, superseded or withdrawn documents.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.