Responsibility for validation passes to another body. Where it only validates, the implementing organization and the validating body agree the requirements and validation set before testing and review them at confirmation. Where the external body also produced the processes, the implementing organization makes sure a sufficient validation against the confirmation requirements exists to meet the confirmation criteria, and obtains the details of the requirements and validation set from the validating body.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.