Within a year of signing, show action that measurably increases customers' installation of security patches. Example approaches: automatic patch installation enabled by default where appropriate, broad patch support, stating a product's expected lifespan at sale and communicating end of life clearly with help to move to supported versions, and patching cloud and SaaS products so customers need not; progress may be shown by patch adoption statistics by product or a blog post.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.