Intermediate control principles for patch and change management (required, with baseline, of an AI whose inherent risk is medium). Tools or processes show missing security patches and how long each has been available; missing patches across all environments are prioritised and tracked; operational impact is evaluated before deploying security patches; patches for high-risk vulnerabilities are tested and applied on release, or the risk is accepted with named accountability. Change management: changes are approved by an authorised individual or committee with the right knowledge and authority and separation of duties, and cyber risk is evaluated in the analysis, approval, testing and reporting of changes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.