To simulate the STIG DISA requires access to the software: the vendor lends it to DISA under a product loan agreement (the form, available on request, governs DISA's use of vendor-owned or licensed hardware and software for STIG testing in the DISA lab and its language is not to be changed), provides an environment at its own or another DOD site, provides remote access for the SME, or another option agreed for the situation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.