The organization monitors and measures the characteristics of the product to confirm product requirements are met. This is done at the relevant stages of product realization, following planned, documented arrangements and documented procedures. Evidence that the acceptance criteria were met is kept. The person who authorized release of the product is identified in the records, and where appropriate the records identify the test equipment used for the measurement activities. Product is not released and services are not delivered until the planned arrangements have been completed satisfactorily. For implantable medical devices, the organization records who carried out each inspection or test.
This control maps to 5 controls across 5 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 5 it maps to, and the evidence behind each claim, over MCP and REST.