Management reviews the management system at planned intervals to keep it suitable, adequate and effective, assessing opportunities for improvement and whether the system, including resilience policy and objectives, needs to change; results are clearly documented and records kept (see A.6.5). Annex B says the review covers the whole scope, possibly in parts over time, on a set schedule, and is also triggered by a completed risk assessment, industry trends, new regulation, a disruptive incident and exercise results.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.