At each development phase, design decisions on how to meet requirements become requirements for the next phase; because they come from the design process they can add behaviors or characteristics beyond those in higher-level requirements, and are called derived requirements. Examples are the requirements for a separately selected power supply (whose development assurance level follows the classifications of the function it supports), the different consequences of choosing a triplex or a dual-monitored architecture, isolation of more severe functions from less severe ones, and requirements defining the hardware-software interface, some of which matter at system level while the detailed rest falls under DO-178C and DO-254. Each derived requirement is examined to establish the functions it serves, so that it receives the correct failure condition classification and is validated (see 5.3.3); they are captured and treated like other requirements at that phase and carry their rationale or references to applicable design standards.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.