Where patches cannot be applied to specific OT systems without severely degrading the capability to meet business critical functions, the strategy must describe, with a timeline, additional mitigations addressing the risk of not installing the patch.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.