The organization plans and develops the processes it needs to realize the product, keeping them consistent with the rest of its quality management system processes. It documents one or more risk management processes covering product realization and keeps records of the risk management work done. When planning, it determines as appropriate: the product's requirements and quality objectives; whether product-specific processes, documents and resources are needed, including infrastructure and work environment; the product-specific activities for verification, validation, monitoring, measurement, inspection and testing, handling, storage, distribution and traceability, together with the criteria for accepting the product; and the records needed to show that the product and the realization processes meet requirements. The output of this planning is documented in a way that suits how the organization works.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.