Art.29 Processing under authority of controller
What the standard requires
The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.
Quoted verbatim from Regulation (EU) 2016/679 (GDPR), consolidated text, which is in the public domain.
Cross-framework mappings
No cross-framework mapping is seeded for this control. That is stated rather than filled in: a mapping nobody authored is worse than a gap you can see.
Track Art.29 with evidence behind it
In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.