Buying goods and services, engaging contractors and outsourcing work can create or worsen psychosocial risk, so the organization controls it by considering how purchases affect workers (visitors on site, delivery timing that disrupts schedules, workload, performance and training), how contractors affect culture, roles and expectations, how outsourcing affects schedules, workload, tasks, supervision and work quality, and how responsibility for worker health, safety and well-being is divided between it, its contractors, suppliers and other parties.
This control maps to 3 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.