For every RXSWIN an auditable register describes all software relevant to it before and after an update, with software versions and integrity validation data for each piece. The Interpretation Document: integrity validation data should let a suitably skilled person verify the software has not been manipulated; the register records, per RXSWIN, the functionality description, the Regulations affected, the relevant software, its integrity data and the method generating it, and per update the RXSWINs affected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.