The policy may state the vendor's disclosure timeline: the target period from receipt to advisory, the conditions under which it is extended (third-party components, complex fixes) and what happens if the vendor cannot meet it, consistent with the embargo practice of 5.6.8 and the timing of 7.3.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.