Confirm that patching is covered by maintenance contracts with clear roles, that contracts allow timely patching including nights and holidays, and that vendors can meet patching SLAs and SLOs even when many institutions need patches at once; prepare for vendor capacity shortfalls with prioritisation and risk acceptance processes for delays; and for jointly operated or cloud-provided systems, ensure contracts provide reporting on patching SLAs and SLOs, their scope and status.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.