A B/D understands how the provider mitigates vulnerabilities, including how it decides patch priority and how quickly patches are applied, and agrees the patch management process with the provider, recognising that patches change code and can harm confidentiality, integrity or availability if mishandled.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.