The manufacturer provides the requesting organisation with all the information the MDS2 asks for (the data the device stores or transmits, how it does so, and its other security features), based on the specific device design, software development and production, and written for cybersecurity use. Every question is answered with Yes, No or N/A; where more is needed the answer adds 'See Note X' and a note clarifies it. Sections that do not apply are still answered No or N/A throughout. Where answers vary with installed options or accessories, the note says so for each question. Long answers may point to other published documents (hyperlink, document identifier, location in the document) with a short summary and how to obtain the document; where several answers cite notes, each gives the exact note location. Software-only devices (apps, plug-ins) answer the applicable sections and mark sections that concern only physical devices N/A. A manufacturer may attach further material for recommended practice or explanation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.