The advisory should state the remediation: the patch, update, configuration change or workaround, how to obtain and apply it, and any temporary mitigation where a full fix is not yet available (ISO/IEC 30111 7.1.5).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.