Where a PEMS is meant to be connected into an IT-network that its manufacturer does not validate, instructions for implementing the connection are made available giving the purpose of the connection, the required characteristics and configuration of the network, the technical specifications of the connection including security specifications, the intended information flow and routing among the PEMS, the network and other devices, and the hazardous situations that follow from the network failing to provide the required characteristics (connecting to a single device such as a printer creates a two-node network unless validated by the manufacturer); and the accompanying documents instruct the responsible organisation that connecting the PEMS to a network including other equipment could create previously unidentified risks to patients, operators and third parties, that it should identify, analyse, evaluate and control them (IEC 80001-1 gives guidance), and that subsequent network changes (configuration changes, connecting or disconnecting items, updates and upgrades of connected equipment) could introduce new risks needing further analysis.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.