The organization should set up, operate and keep current a configuration management process, coordinating its activities so that it works effectively; the process should concentrate on the requirements for the product or service, including those that customers and other relevant interested parties set, and on applicable legal and regulatory requirements, with the context taken into account. A configuration management plan should describe the process in detail, including any documented information specific to the project and how far the process applies across the product's or service's life cycle.
This control maps to 7 controls across 4 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 7 it maps to, and the evidence behind each claim, over MCP and REST.