# PLT-003: Deploy silently through endpoint management with release controls


- Area: Platform, Privacy & Assurance

- Verification: Proof of value
- OWASP adoption tier: AT0–AT4
- Formerly: ARC-016
- URL: /r/PLT-003

**Acceptance criteria:** Deploy and update every component silently through the buyer's endpoint management tools on Windows, macOS and Linux and all major browsers, with release rings, version pinning, rollback and a central view of deployment health by device.

**Why it matters:** Deployment is where enterprise controls most often fail.

**How to verify:** Pilot devices are deployed silently through your endpoint management, with deployment health visible.

**OWASP adoption context:** Endpoint components underpin coverage in every listed context, so deployment health determines real coverage.

**Mappings:**
- NIST CSF 2.0: PR.PS-02, ID.AM-08; SOC 2: CC8.1; ISO 27001: A.8.32, A.8.9 — Managed deployment with release rings, pinning and rollback brings the control's own software under change and configuration management. Deployment health still has to be monitored; an install that fails silently does not meet this requirement.
- NIST AI RMF: MANAGE 2.4; ISO 42001: A.6.2.5 — Staged releases and rollback let the buyer contain a faulty update without losing protection everywhere. They are deployment safeguards, not evidence that each release is correct.