NIST SP 800-40 Rev 4 - Guide to Enterprise Patch...

What does 3.6a require?

Organisations should take advantage of the low-level metrics they already hold, such as asset inventories with their technical and mission characteristics and vulnerability data like CVSS scores, exploitation intelligence and scanner outputs, when developing enterprise-level metrics of patching performance for audiences from the board and CIO or CISO to business unit leaders, developers and administrators, each of whom needs a different cut.

Other controls in Section 3: Recommendations for enterprise patch management planning – NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning

3.1.1 Reduce the number of vulnerabilities entering the environment
3.1.2 Deploy applications so that patching is less likely to disrupt operations
3.2.1 Keep software inventories for all computing assets constantly up to date through automation
3.2.2 Use the inventory capabilities built into platforms and assets
3.2.3 Treat patching per asset: record each asset's technical and mission characteristics
3.3 Define the risk response scenarios to be ready for
3.4 Assign every asset to a maintenance group
3.5 Define a maintenance plan for each group and scenario, with a process for choosing between plans

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning controls