NIST SP 800-40 Rev 4 - Guide to Enterprise Patch...

What does 3.5.4a require?

Organisations should plan several long-term risk mitigation methods other than patching for vulnerable unpatchable assets, with an approved set per maintenance group reviewed in advance by security architects or engineers for adequacy; isolation techniques such as micro-segmentation and software-defined perimeters (NIST SP 800-207 section 3) are examples.

Other controls in Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

3.1.1 Reduce the number of vulnerabilities entering the environment
3.1.2 Deploy applications so that patching is less likely to disrupt operations
3.2.1 Keep software inventories for all computing assets constantly up to date through automation
3.2.2 Use the inventory capabilities built into platforms and assets
3.2.3 Treat patching per asset: record each asset's technical and mission characteristics
3.3 Define the risk response scenarios to be ready for
3.4 Assign every asset to a maintenance group
3.5 Define a maintenance plan for each group and scenario, with a process for choosing between plans

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning controls