The organization plans, runs and controls the processes required to meet requirements and deliver the clause 6 actions, by setting process criteria and controlling processes against them, with enough documented information to be confident they ran as planned. It controls planned changes and reviews unintended ones, mitigating harm (see 8.1.5), and controls the relevant processes, products and services it obtains from outside (8.1.6). It also plans and controls processes to adapt work to workers and to improve work-related well-being, coordinates the relevant parts of its system with other employers at shared workplaces, and considers backing up its risk assessment with a check of controls at the point of work where a situation cannot be judged fully beforehand, such as emergencies or changing conditions.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.