The provider has access to the data and information it needs. Its information management system, computerised or not, used to collect, process, record, report, store or retrieve data is validated for functionality including interfaces before introduction, and any change, including configuration or modification of commercial software, is authorised, documented and validated before implementation (general-purpose commercial software within its design range counts as validated). The system is protected from unauthorised access, safeguarded against tampering and loss, operated in an environment meeting supplier or provider specifications or, for manual systems, conditions that safeguard accurate recording and transcription, maintained to preserve data integrity, and records system failures with the immediate and corrective actions taken. Where the system is managed off-site or by an external provider, that operator complies with the applicable requirements; instructions, manuals and reference data are readily available to personnel; and calculations and data transfers are checked appropriately and systematically.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.