NIST SP 800-40 Rev 4 - Guide to Enterprise Patch...

What does 3.5.3a require?

Organisations should plan for rapid application of multiple types of emergency mitigation to protect vulnerable assets, such as switching off functionality or isolating an asset, with automated mechanisms to apply the changes, because without ready processes, procedures and tools too much time is lost and assets are compromised.

Other controls in Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

3.1.1 Reduce the number of vulnerabilities entering the environment
3.1.2 Deploy applications so that patching is less likely to disrupt operations
3.2.1 Keep software inventories for all computing assets constantly up to date through automation
3.2.2 Use the inventory capabilities built into platforms and assets
3.2.3 Treat patching per asset: record each asset's technical and mission characteristics
3.3 Define the risk response scenarios to be ready for
3.4 Assign every asset to a maintenance group
3.5 Define a maintenance plan for each group and scenario, with a process for choosing between plans

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning controls