A process makes update documentation available to users (for example via a security contact or periodic publication) giving the affected versions, manual and automated installation instructions, impacts such as reboots, how to verify installation, and the risks of not patching with mitigations for unapproved or undeployed patches.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.