The organization has documented procedures that make sure what it buys conforms to the purchasing information it has specified. It sets criteria for evaluating and choosing suppliers that take into account whether the supplier can deliver product meeting the organization's requirements, how the supplier has performed, how the bought product affects the quality of the medical device, and the risk the device carries, in proportion. Monitoring and re-evaluation of suppliers are planned; supplier performance is monitored against the purchasing requirements, and the results feed the re-evaluation. Where a supplier fails to meet requirements, the organization takes it up with the supplier in proportion to the risk the purchased product carries and to its effect on regulatory compliance. Records are kept of supplier evaluation, selection, monitoring and re-evaluation and of any actions that result.
This control maps to 3 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.