The organization decides what monitoring and measuring must be done, and what equipment is needed, to give evidence that product conforms, and documents procedures so that monitoring and measuring can be, and actually are, done in a way consistent with the requirements. Where valid results depend on it, measuring equipment is: calibrated or verified, or both, at set intervals or before use, against measurement standards that trace back to national or international standards (if none exist, whatever basis is used for calibration or verification is recorded); adjusted or re-adjusted as needed, with each adjustment recorded; identified so its calibration status can be seen; protected from adjustments that would invalidate the results; and protected from damage and deterioration. Calibration and verification are done according to documented procedures. If equipment turns out not to conform, the organization assesses and records whether earlier measurement results are still valid, and acts on the equipment and on any product affected. Records of calibration and verification are kept. The organization also documents procedures for validating software used in monitoring and measuring, applied before first use and after any change, in proportion to the risk, including the effect on product conformity, and keeps records of the validation results, conclusions and actions.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.