Critical thinking is applied through the whole life cycle so that the approach for each system is customized and proportionate rather than driven by rigid templates and tick-box methods: the organization analyses the business process and the regulated data the system supports, considers the technical, procedural and behavioral controls that exist upstream and downstream of the system, and focuses assurance where it is most needed. The level of compliance is not proportionate to the amount of paperwork; regulators expect focused, proportionate activities whose records are well organised, suitably detailed and backed by clear reasoning, and the information held in software development and support tools may be used to demonstrate control instead of separate documents.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.