The organization must make sure that personal data it handles for a customer is used only for the purposes set out in that customer's documented instructions, with the contract stating what the service is for and how long it runs. It should recognise that, for technical reasons, it may be right for the organization to choose how processing is carried out, in line with the customer's general instructions, without explicit direction. The customer must be able to check that purpose specification and limitation are respected, which also makes sure neither the organization nor its subcontractors use the data for any other purpose.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.