Three assessments shape the strategy. First, an initial risk assessment during planning establishes whether the system is GxP regulated, what its impact is, and whether more risk assessment will be needed. Second, the system's components are assessed against the software and hardware categories to inform which activities are required, allowing for architecture, complexity, novelty, maturity and how much configuration or customisation is involved, this being one of several inputs to critical thinking. Third, a supplier assessment formally establishes the quality capability of each supplier, usually carried out by a subject matter expert and including an audit where risk, novelty and complexity warrant, with recognised certifications and independent reports such as SOC 2 taken into account; any decision not to assess a supplier is justified in writing, and suppliers are helped to understand the expectations where needed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.