Discloses who can install and update security patches on the device (service engineers on site or working remotely, or authorised customer staff), noting any manufacturer restrictions on applying patches (device changes, including cybersecurity changes, often need design validation under quality-system rules such as 21 CFR Part 820). CSUP-1: does the device contain software or firmware that may need security updates during its life from the manufacturer or a third party (if not, the section is N/A). For each component class, the operating system (CSUP-2), drivers and firmware (CSUP-3), anti-malware software (CSUP-4), commercial off-the-shelf components other than the operating system (CSUP-5) and other software components such as asset or licence management, described (CSUP-6), four questions follow: does the documentation instruct the owner or operator how to install patches or updates (x.1); is vendor or vendor-authorised service required to install them (x.2); can patches or updates be installed remotely (x.3); and does the manufacturer allow third-party security updates, for example from the operating-system vendor, to be installed without its approval (x.4). Then: does the manufacturer tell customers when updates are approved for installation (CSUP-7); does the device install updates automatically (CSUP-8); does the manufacturer keep a list of third-party software it has approved for installation, and a process for requests to add to it (CSUP-9); can the owner or operator install approved third-party software themselves (CSUP-10), and is there a mechanism preventing installation of unapproved software (10.1); does the manufacturer run a process for evaluating vulnerabilities and updates affecting the device (CSUP-11), tell customers where each update stands in its review and approval (11.1), and review updates for the device on a regular cycle (11.2).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.