The manufacturer demonstrates that its CSMS processes ensure that, based on the categorization of 7.2.2.2(c) and (g), cyber threats and vulnerabilities requiring a response are mitigated within a reasonable timeframe. The Interpretation Document: after classification a process sets a response deadline (for example through triage) and monitors execution against it; the timeframes, possibly a set for different situations covering decision and implementation, must be justified; ISO/SAE 21434 defines no timeframe.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.