Critical security updates to software, meaning those that address an imminent risk to account data, are applied to deployed POI devices no later than 30 days after the device or application vendor supplies them, whether the provider pushes them or the device or merchant pulls them, with the solution provider keeping responsibility.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.