For Transient Cyber Assets managed by another party, mitigate the risk of unpatched software, per capability, by reviewing installed patches, the party's patching process or other vulnerability mitigation, or another method.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.