Known software and configuration weaknesses are found through continuous, repeatable assessment that includes vulnerability scanning; patches and updates are applied within risk-based deadlines, or automatically where the operational impact is low; and vulnerabilities above the organisation's risk thresholds are fixed or mitigated within set timeframes that weigh how exploitable and exposed the asset is, its criticality and impact, and what compensating controls exist, with the treatment checked to confirm it worked. Marked across the technical domains.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.