ISO/IEC 29147 shall be applied alongside this document. ISO/IEC 30111 gives vendors the process for investigating, triaging and fixing vulnerabilities reported by people or organizations inside or outside the vendor, whereas ISO/IEC 29147 deals with how the vendor interacts with the people who discover and report potential vulnerabilities, where reports are received and where remediation information is released (Figure 1).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.