The asset owner shall maintain the patch status of IACS components, knowing which patches are installed, which are pending and which cannot be applied.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.