Accountable management implements and manages an ONF audit programme integrated with existing audit processes (particularly ISMS audits, with ISO/IEC 27007 and ISO 19011 as guidance), ensures auditors are trained for ONF audits, has the ONF audited, has root causes of nonconformities found and solutions proposed (domain experts responsible), documents and communicates results, and feeds them to the monitoring process. The programme needs management approval, resources and independence so it can show objectively that responsibilities are defined and communicated, elements are cost-effective and current, change management is followed, management sub-processes are completed, their verification activities performed, and previous audit and risk results considered. External auditors mandated by management, outside the committee's authority, verify that the audit process was performed, with separation between realisation and verification. The audit also serves to show compliance with a parent or regulatory ONF.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.