Publish a policy that authorises testing of all the manufacturer's products and states the conditions, gives legal safe harbour for good-faith testing within the policy, and permits public disclosure after a set timeline; perform root cause analysis and remove whole classes where feasible. CISA's VDP template is the reference.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.