I understand that determining limits depends largely on the business, understanding of the risk, business requirements, etc.

but my question is are limits defined anywhere in that a system must be patched by some certain time of discovering the vulnerability?

this is an extremely complex hill for us to climb as some systems are legacy and or proprietary. they are entirely closed off systems and have no access to the internet. in some cases some of these systems will never be patched, they will instead be replaced.

would help to understand any CMMC / NIST defined limits or best practices.

thanks