The entity must document and implement vulnerability management procedures that keep trusted sources of vulnerability information current; run automated vulnerability scanning and assessment on ICT assets at a frequency and scope matching classification and risk, and at least weekly for assets supporting critical or important functions; check that ICT third-party providers handle vulnerabilities in their services, report at least critical vulnerabilities and trends promptly, and investigate root causes and mitigate when asked; track third-party and open-source libraries used by services supporting critical or important functions and by in-house or bespoke services, monitoring versions and updates; set up responsible disclosure to clients, counterparties and the public; prioritise patches by criticality, classification and risk; and record vulnerabilities and verify their remediation. Patch management procedures must use automated tools where possible to identify patches, provide emergency patching, test and deploy patches under the environment rules of Article 8(2), and set installation deadlines with escalation when deadlines slip.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.