Security guidance is available for users and for administrators, including manufacturer sales and service, preferably as separate manuals so that full administrative functions are known only to administrators. Users are clearly told their responsibilities and the secure way of working; administrators get information on managing, customising and monitoring the system, such as access control lists and audit logs, and a clear understanding of the security capabilities for health data risk assessment under the applicable regulation; sales and service learn the security capabilities of the system and how to work with it securely; and all are asked to inform the manufacturer of observed weaknesses. IEC 80001-1 Annex B, IEC 81001-5-1 Annex E and the IMDRF cybersecurity principles describe the customer security documentation expected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.