The device description section identifies: the manufacturer's name (DOC-1); a device description in standard terms (FDA product code, ECRI device code or another generic name), never an internal marketing, trademark or copyrighted product name (DOC-2); the marketed model as on the nameplate, identification tag or catalogue (DOC-3); the manufacturer's document identifier (DOC-4); a role or department email and main phone number (DOC-5); the device's intended function and use when connected to the customer network (DOC-6); the release date (DOC-7). It then asks whether the manufacturer runs a coordinated vulnerability disclosure programme for the device, with details in a note (DOC-8); whether it is a member of any ISAO (Information Sharing and Analysis Organization) (DOC-9); whether a network or data-flow diagram of connections to other components or external resources exists (DOC-10); and whether the device is Software as a Medical Device (DOC-11), and if so whether it contains an operating system (11.1), relies on one the owner or operator provides (11.2), or is hosted by the manufacturer (11.3) or by the customer (11.4).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.