Patch or apply documented compensating controls for all known exploited vulnerabilities in critical systems without delay, keep a way to receive publicly submitted vulnerabilities and to share threat information, allow no exploitable channels directly exposed to internet-accessible systems, connect no OT to the public internet unless required and justified, and run vulnerability scans as the plan specifies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.