Supplementary control: at least one named person should hold responsibility for information security. Aim: clear direction, visible management support and adequate technical expertise for health information security. Health guidance: accountability and coordination survive over the long term only where information security management has an explicit infrastructure; an information security officer, or access to one, coordinates information security, and top management is accountable for all of it. Organizations with a workforce above about 500 or a client base above about 10 000 should set up an advisory group on information security (committee or board) that meets regularly, typically monthly, and includes, beside the officer, representatives who use health IT systems (doctors, nurses, other clinicians, managers, administrators) and those professionally responsible for operating the systems and services (ICT staff and the professionals who engineer medical devices and hospital systems). Annex C gives more on advisory groups.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.