NSS owners and operators must report progress in updating to CNSA 1.0 and CNSA 2.0 as part of their NSM-8 and NSM-10 responsibilities; authorizing officials report regularly on CNSA 2.0 adoption under NSM-10, use the available tools to ensure every system that uses cryptography for security, including software update mechanisms, implements CNSA 2.0, and report any deviation to NSA under NSM-10 processes; as long as any component of an NSS is not quantum-resistant, including a validated profile that still needs a CNSA 1.0 algorithm to function securely, the NSM-10 reporting requirement continues, which NSA expects for many customers through 31 December 2031.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.