After development the first draft enters Validation: the DISA SME reviews the package at a high level for the completeness and rationale of each requirement's status and justification; once the package is complete a transition meeting with the vendor, the DISA SME and a Technology SME hands the process to the Technology SME, who develops a test plan and simulates the STIG on the product to validate that its content correctly determines what is and is not a finding and brings a system into compliance, documenting the outcome for each requirement and working with the vendor on items found technically incorrect or needing substantial rework; the vendor may be called on for questions about product setup or the content.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.