HUMAN VERIFICATION REQUIREDASVS 15.1.1 Dependency remediation deadlines are documented
MB-C13Application Behavior & Human AssuranceMedium
Application documentation defines risk based remediation time frames for 3rd party component versions with vulnerabilities and for updating libraries in general, to minimize the risk from these components.