AIR describe how asset information is to be produced, from managerial, commercial and technical angles. On the managerial and commercial side they cover the information standard the delivery team uses and the procedures and methods it follows in production; the technical side specifies the detailed information that answers the OIR relating to assets, written so it can be built into asset management appointments. A set of AIR should be drawn up for every trigger event and should refer to security requirements where relevant. AIR can be split down the supply chain and added to, and across appointments they should form a single consistent set that answers every OIR relating to assets.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.