The organization sets up, operates, keeps up to date and continually improves its QMS, together with the processes the system needs and the way they interact. For each process, and for its use across the organization, it settles the inputs needed and outputs expected, the order in which processes run and how they connect, the criteria and methods (measures and performance indicators included) that make operation and control effective, the resources required, who holds responsibility and authority, which risks and opportunities are being addressed, how the process is evaluated and changed so it achieves what is intended, and how processes and the system are improved. Documented information is kept to support how processes run, and retained to give confidence they ran as planned.
This control maps to 17 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 17 it maps to, and the evidence behind each claim, over MCP and REST.