Medical device manufacturers apply the ISO 14971 risk management process, whose third edition and its guidance ISO/TR 24971 cover security risk because harm includes damage to property and the environment and a hazard can be a loss of confidentiality, integrity or availability exploited through a vulnerability; security concepts should be mapped and security-specific activities added within that framework, or a parallel security risk process on the AAMI SW96 model with the same steps can be run, mapping vulnerabilities, threats and exploits with the models in AAMI TIR57 and SW96. Either way, the process also handles mutual adverse effects between security and usability controls. Organisations other than device manufacturers need not use ISO 14971 but still apply ISO 81001-1 risk management (identify, assess, control, monitor), for example the IEC 80001-1 process of risk analysis, evaluation, control, benefit-risk analysis, verification of controls and residual risk evaluation and reporting when integrating health IT into the infrastructure.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.