The manufacturer shall make available to the public a vulnerability disclosure policy, including a contact for the disclosure of vulnerabilities and an acknowledgement timeline; received reports shall be acted on within a reasonable time, with status updates to the reporter.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.