At least yearly, and sooner when something changes, senior management reviews the management system for quality and product safety, taking in as a minimum audit outcomes, customer feedback, where preventive and corrective actions stand, the objectives, actions carried over from the last review, changes that might affect the system and ideas for improvement; the review also judges how well the system is controlled and improved. On a regular basis, through internal audits or site inspections for instance, the company reviews the infrastructure it needs (buildings, supply systems, machinery and equipment, transport) and, at least annually, the working environment (staff facilities, hygiene, workplace safety and security), and feeds the findings into risk-based investment planning.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.