The repository records the functional IT needs common across the organisation and the solutions already approved to meet them: every specification, functionality and service in or offered by its applications, along with the guides and good practice for putting each in place, operating it and checking it. It lists all application specifications, for each one the approved processes and best practices for its implementation, use, maintenance and verification, the risks the specifications bring and the mitigating security requirements. Pre-approved solutions (processes, products, code libraries made recommended or mandatory) are registered so that selecting a specification in a project pulls in the ASCs that mandate the approved solution.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.