Guidance: the people running the programme should choose methods that let each audit be carried out efficiently and effectively in line with what it sets out to do, what it covers and what it audits against. An audit may be carried out on site, remotely, or in a mix of the two, balanced with regard to the associated risks and opportunities. For joint audits by two or more auditing organizations the programme managers should agree the methods and their resourcing and planning implications; combined audits may be included where an auditee runs systems of different disciplines.
This control maps to 12 controls across 10 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 12 it maps to, and the evidence behind each claim, over MCP and REST.