The agency identifies the applicable statutes, regulations and binding policies issued government-wide, sets internal policies and capabilities to assess compliance, and extends compliance to acquisition, billing and renewal and termination of services, not only deployment and operation; it assesses industry standards and best practice to secure a baseline of operability across physical security, continuity and data controls, covering cloud-specific, intersecting on-premises and enterprise policies; it reassesses when providers change features or terms; and it enforces policy at deployment through infrastructure as code and policy as code with monitoring, remediation and automatic enforcement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.