Patches, updates or other vendor mitigations for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.