Products and services from external providers that affect the laboratory's activities may be used only if they are suitable, whether they become part of its own activities, go to the customer exactly as received, or support how it runs. It shall have a procedure, and keep records, for: defining, reviewing and approving what it requires of them; setting criteria for evaluating, selecting, monitoring and re-evaluating providers; making sure what is provided meets the laboratory's requirements, or what this document requires of it, before it is used or passed on to the customer; and acting on the outcome of evaluations. It shall tell providers what products and services are needed, the acceptance criteria, the competence and qualifications required of their people, and any activity that it or its customer plans to carry out on the provider's premises.
This control maps to 3 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.