The product allows security updates to be installed, with an unambiguous agreement about which party holds technical responsibility for each part of patch management of the software and its environment, and a standardised process for installation and upgrade by on-site service, remote service or authorised HDO staff. Applicable patches and mitigations are installed as soon as possible after a risk assessment in line with regulation: high-risk vulnerabilities take highest priority; vendor and HDO both make sure clinical function stays safe and effective, mindful that a medical device is not patched or modified without the manufacturer's explicit written instruction; adequate testing finds side effects that could endanger a patient; and HDO IT and service staff are told proactively which patches have been assessed or validated. Communication to the end user covers the expected patch release schedule, whether the manufacturer notifies approved updates, whether installation is automatic, any approved list of third-party software and whether the user may install it, any mechanism blocking unapproved software, the vulnerability and update assessment process, and the review and approval status of updates; manufacturer restrictions on applying patches and every software or firmware item needing security updates in its operational life are documented, for example through the SBOM.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.