; and (ii) establishes design components and traces such components to design compensating controls. (C) A description of any manufacturer compensating controls that— (i) effectively address known common vulnerabilities and exposures; and (ii) provide providers with industry standard compensating controls for improving cybersecurity. (D) A description of— (i) any cybersecurity evaluation conducted on the device, including any testing, validation, or verification of the device; (ii) who conducted such evaluation; and (iii) the results of such evaluation. (E) A cybersecurity risk assessment conducted by the manufacturer, or a third party, explaining the risk of the device to patient safety and clinical hazards. (F) An indication of whether the device is capable of being remotely accessed. If the device is capable of being remotely accessed, an indication of any security measures and access protocols the device has in place to secure such access. (3) Disclosure of report card (A) Clearance or approval The manufacturer of any cyber device shall include the report card in any notification to the Secretary under section 510(k) or any application for premarket approval under section 515(c), as applicable. (B) Public accessibility (i) In general The Secretary shall provide a copy of the report card to any entity described in clause (ii) that submits a request for such copy to the Secretary. (ii) Entities permitted access An entity described in this clause is— (I) any health care industry entity, consisting of any provider, device manufacturer, the Federal Government, health care information security researchers, and health care academia