The entity works out what valuable information processing resources it holds, identifies the relevant threats and vulnerabilities and determines the potential consequences, exploring threats and scenarios systematically with tools such as ISO/IEC 27005, the NIST Cybersecurity Framework or SP 800-30, including threats from supply chain dependencies, OT and data exchange with healthcare institutions. Identified risks are assessed and classified by probability and impact using NEN-EN-ISO/IEC 27001 supported by BIO guidance, so that risk priorities are consistent across the entity and government. Controls are then selected from ISO/IEC 27001 Annex A as elaborated in ISO/IEC 27002, supplemented by the government measures, which are mandatory in every case and may never be accepted as a risk, whatever the entity's own assessment, unless they are inapplicable.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.