Under ISO 13485:2016 clause 8.2.1, post-production feedback for devices with a device software function, software, firmware or programmable logic (whatever their authorization date) should systematically collect vulnerability reports, security incident data and relevant threat intelligence, for example from coordinated vulnerability disclosure, regulator cybersecurity communications, sector information sharing networks and customer reports, and assess new threats for their effect on safety and performance. The organisation has to use this cybersecurity feedback as input to risk management (7.1), improvement (8.5) and design change control (7.3.9).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.