ISO/IEC 27002:2022 control 8.19 applies, with telecommunications guidance: manage changes so the chance of damaging operational systems is kept low. Changes to the application or operating software of critical systems are tested thoroughly and can be rolled back; at least three generations of sensitive application software are kept; and updates, patches and other changes go through regression testing on a test system before they reach live use. Only software that has been verified and approved goes onto sensitive systems such as network elements and operations systems, and only authorised maintenance staff may install software on those systems or on the terminals used to manage them. Software capable of harming the performance or security of sensitive systems is controlled and monitored.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.