A patch management process should ensure applicable functional and non-functional patches, including security fixes, are implemented within timeframes commensurate with the criticality of the patch and of the system, and patches should be tested before production to confirm compatibility and that no new problems are introduced.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.