A checklist is created from one or more STIGs for a target system and each rule's status is set to Not a Finding, Open, Not Applicable or Not Reviewed (cycling by clicking the status circle); as statuses change the checklist's progress chart and score update. Target data (host and system identity, with a classification level where set or where classification options are enabled) is populated on the checklist, and comments and finding details are added to a single rule or to several rules at once; checklists are saved and can be exported to CSV.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.