Organisations should weigh software maintenance among the factors in procurement, using a questionnaire to the supplier such as: whether and how often it will release security updates and how fast it fixes vulnerabilities; how many years it commits to correcting vulnerabilities; whether releases follow a schedule, arrive as needed or both; whether it runs a vulnerability disclosure and incident response programme and communicates openly; what customers should do while a public vulnerability has no patch and whether an emergency mitigation will be offered; how disruptive updates are (restart or reboot); and how patches are tested, how often they cause problems and whether rollback is supported.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.