The vendor should keep the reporter informed for the life of the case: confirming receipt, sharing the outcome of verification, giving progress updates while the remediation is developed and telling the reporter the planned disclosure date, at the cadence the policy's communication expectations (9.3.4) set. The UK PSTI regulations require a manufacturer relying on this paragraph to publish when a reporter will receive such updates, and the CRA harmonized-standard draft cites the clause for its on-going communication requirement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.