Explicit agreement on the stakeholder requirements is obtained with the designated stakeholders, usually through requirements reviews by a constituted group (including an acquirer representative on acquirer-driven projects) that looks for errors, mistaken assumptions, unclear or unverifiable statements and departures from standard practice, aided by checklists; agreement may cover subsets only, and conflicting needs are still recorded. Trace links between stakeholder needs and stakeholder requirements are set up and kept to show how the formal requirements meet the stakeholder objectives; they are captured, traced and maintained through the life cycle and placed under configuration control, preferably in a requirements management tool able to trace linkages. The repository is first populated with the source documents of the needs, project constraints and conditions; the source and rationale of every requirement and its attributes, including priority and criticality, are kept. The baselined items provided include the stakeholder requirements specification, the concept of operations and the operational concept, with the repository as a key artifact.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.