Purchasing information describes, or refers to, what is being bought. Where appropriate it covers product specifications; requirements for accepting the product, and for the procedures, processes and equipment involved; requirements for qualifying the supplier's staff; and quality management system requirements. Before passing purchasing requirements to a supplier, the organization makes sure they are adequate. Where applicable, the purchasing information includes a written agreement under which the supplier tells the organization about changes to the purchased product before making any change that affects whether the product still meets the purchase requirements. As far as traceability needs, the relevant purchasing information is kept as documents and records.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.