Intended use, environment of use, the health IT system and infrastructure and local factors determine which capabilities are needed and which controls best establish them, and a security risk assessment is used to find capabilities beyond the listed ones. Capabilities are expected to arrive in a secure default state and to be adjustable so the HDO's security policy can be followed, and every adjustable capability must be clearly communicated. Annex D maps each capability to confidentiality, integrity, availability, accountability and authenticity.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.