The appointing party sets, per appointment and trigger event, the EIR (ISO 19650-3) it needs in order to satisfy its AIR and, through them, its OIR: (a) security-minded considerations identified under ISO 19650-5; (b) the information to capture when responding to the trigger event, matched to the required level of information need (described in 11.2 of part 1); (c) when and how often exchanges happen in the appointment; and (d) acceptance criteria for each requirement, reflecting the asset information standard, the procedures and methods for production, and any reference information or shared resources provided. Drafting EIR for foreseeable trigger events ahead of time avoids holding up appointments, which is important in emergencies such as critical equipment failure and where the response turns into a new build or major refurbishment.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.