Description Third-party components are scanned for known vulnerabilities prior to release, with a defined remediation SLA. Context Weight 1 Control area Security in system acquisition, development & maintenance MOSCOW Must Control Framework NIS2