Every capability is a potential security risk control option, chosen once the need to mitigate a security risk has been identified: the capability goal lists the risks it can address and the user need lists the aspects that must be considered when it is applied. How the software is intended to be used, and in what environment, within the health IT infrastructure inform which capabilities are selected and at what level, for instance authentication on network-connected products holding patient data. Security requirements for a particular intended use and environment are never adopted or tailored without considering their effect on the safety and effectiveness of the product.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.