Providers must deploy available patches or mitigations (including software updates and equipment replacement) within a period appropriate to the severity of the risk they address, identify and implement needed security updates or upgrades in a period suited to the assessed risk, and have any decision to take more than 14 days over a patch, or on an upgrade where there is significant risk, taken at an appropriate governance level and recorded in writing. The Code's Table 2 gives maximum timeframes: 14 days for actively exploited vulnerabilities, 14 or 30 days for critical and 30 or 90 days for high severity, depending on external or internal exposure.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.