The company controls buying so that all bought-in materials and services affecting safety and quality conform; any outsourced process with such an effect stays under the company's control, which is identified and documented in the management system. A risk-based procedure with clear assessment criteria governs how suppliers and service providers, in-house or outside, are approved and then kept under review; supplier assessments are reviewed at least once a year with records of reviews and resulting actions; and purchased goods are checked against specifications and for authenticity under a risk-based test plan.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.