The organization decides how much control to apply to processes, products and services bought in from outside, according to their OH&S risk. It coordinates procurement to identify hazards and control the risks from the external provider's work affecting the organization, the organization's work affecting the provider's workers, and the provider's work affecting other parties. It ensures external providers and their workers meet the system's requirements and intended results, applies OH&S criteria when selecting providers, puts OH&S criteria into contracts where appropriate, and carries out the opportunities it identified to influence and support suppliers' OH&S performance. The draft folds the first-edition procurement, contractor and outsourcing sub-clauses into this one.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.