A verification team, independent of application development, reviews the outcome of each verification measurement for all ASCs that the target level for the application calls for, and from them determines the Actual Level of Trust. If the Actual Level equals the Targeted Level the owner holds documented evidence that the application's information security risk is now down to a level it can accept. Verification may run at any time in the life cycle under verification policies, using inspection, review, unit testing and later white box or black box, integration or penetration testing.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.