Baseline control principles for patch and change management (required of every AI (minimum for a low inherent risk)). A patch management programme applies software and firmware patches promptly; systems take patches from official sources; patch reports show missing security patches and drive follow-up; patches are tested before applying and a formal process acquires, tests and deploys them by criticality. Change management: a process requests and approves changes to system configurations, hardware, software, applications and security tools.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.