Disclose and operate third-party component roadmap + security guidance documentation + vulnerability disclosure programme per MDS2 RDMP + SGUD sections and 2022 SBOM additions. Third Party Components in Product Lifecycle Roadmaps (RDMP) including disclosure of third-party software inventory + open-source software + commercial off-the-shelf (COTS) components + medical-device middleware + database engines + operating systems + libraries + their support and security update commitments + planned upgrades + end-of-life and end-of-support dates + Software Bill of Materials (SBOM) (added 2022 update + aligned with FDA Section 524B + NTIA SBOM minimum elements + CISA SBOM guidance + NEMA SBOM Implementation Guide). Security Guidance Documentation (SGUD) including security configuration guides + Manufacturer-Provided Security Guidance + secure deployment guide + secure operations manual + secure decommissioning guide + administrator security manual + privacy and security training resources + Healthcare Delivery Organisation (HDO) handover documentation. Coordinated Vulnerability Disclosure programme + security.txt + responsible disclosure policy + bug bounty programme + ISO/IEC 29147 + ISO/IEC 30111 alignment + FDA Postmarket Cybersecurity Guidance vulnerability handling + CVE/CVD coordination + ICS-CERT/CISA HC3 (Health Sector Cybersecurity Coordination Center) coordination + MITRE Medical Device Cybersecurity playbook + Joint Security Plan (JSP) participation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.