Documented change and patch policies and procedures ensure that the business impact of applying or not applying a patch or change is assessed, changes are applied and reviewed securely and in time with approvals, every change to applications or data is justified by business need and documented through robust change management, and failed changes can be recovered.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.