Monitor and scan the system and hosted applications for vulnerabilities at least monthly and when new vulnerabilities affecting the system are reported, using tools that interoperate through standards for enumerating platforms, flaws and misconfigurations, formatting checklists and measuring impact; analyse the results; remediate legitimate vulnerabilities within 15 days for critical, 30 for high, 60 for medium and 90 for low; share findings with the risk assessment, control assessment and scanning personnel to eliminate similar vulnerabilities elsewhere; and use tools that can readily update the vulnerabilities scanned.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.