Unless there is a valid reason to leave something out, every report shall contain at least: a title; the laboratory's name and address; where the activities took place, including at a customer's facility, off site, or in temporary or mobile facilities; unique identification so that every part is recognized as belonging to the whole, with a clear end; the customer's name and contact details; the method used; a description of the item, its unambiguous identification and, where needed, its condition; the date the item was received and, where this matters, the sampling date; the date or dates the work was done; the issue date; where relevant, which sampling plan and method were used; a statement that the results apply only to the items that were tested, calibrated or sampled; the results, with units; any addition to, departure from or exclusion from the method; who authorized the report; and clear marking of any results that came from external providers. The laboratory answers for everything in the report apart from information the customer supplied, which shall be clearly marked, with a disclaimer where it could affect validity; where the laboratory did not take the sample, the report shall say the results apply to the sample in the condition it was received.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.