After an incident or nonconformity the organization responds: it controls and corrects it and deals with consequences; evaluates whether action is needed on its causes by reviewing it, finding causes and checking whether similar cases exist or could arise; carries out the action needed; checks the action worked; changes the system if needed; revisits existing risk assessments; and assesses risks from new or changed hazards before acting. Corrective action must suit the effects. Records show the nature of each case, the action taken and its effectiveness. The organization also keeps processes for reporting, investigating and acting on incidents and nonconformities, responds promptly with worker or representative participation, applies the hierarchy of controls and management of change when acting, and tells relevant workers, representatives and other parties about incidents and nonconformities.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.