When a new vulnerability is found in software containing a non-inherited cryptographic module, the provider determines whether updating to a newer version, validated or not, would eliminate it and promptly updates if feasible (FRR9), FedRAMP generally preferring elimination of known vulnerabilities over continued use of known-vulnerable validated software; where updating is not currently possible the provider creates or updates a POA&M item based on the criticality of the vulnerabilities with its remediation or mitigation plan to inform ongoing authorization decisions (FRR10).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.