Operate OT configuration + patch + vulnerability + malware protection per NIST SP 800-82 Rev 3 Chapter 6 + Chapter 7. Configuration Management must (a) establish baseline configurations per asset class + version + maintain canonical golden image library, (b) enforce change control with engineering + safety + cybersecurity review for OT changes, (c) detect drift via authenticated configuration scanning + integrity monitoring, (d) align with IEC 62443-2-3 patch management for OT. OT Patch Management must (a) test patches in pre-production OT lab matching production OT topology before deployment, (b) coordinate with vendor support cycles + extended-life OEM commitments, (c) schedule deployment during planned outage windows aligned with operations + safety + regulatory permits, (d) document compensating controls where patching is infeasible (legacy systems + vendor-restricted environments + safety-certified equipment with patch lockdown). Vulnerability Management must (a) consume ICS-CERT advisories + vendor advisories + CISA KEV catalogue + sector ISAC feeds, (b) prioritise based on exposure + exploitability + mission impact + safety impact, (c) implement compensating controls where patching is infeasible (network segmentation + access restriction + monitoring intensification + insurance + spare equipment availability). Malware Protection in OT must (a) prefer application allowlisting over traditional signature antivirus, (b) deploy signature-based AV only where vendor-supported and tested, (c) use removable media controls with sandboxed transfer stations between IT and OT, (d) deploy file integrity monitoring on critical OT hosts.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.