On approval the STIG containing the Applicable-Configurable requirements, with a DISA-provided overview document, goes to the DISA Public Affairs Office for review and approval and is then published and made publicly available on the Cyber Exchange; the requirements with status Not Applicable, Applicable-Inherently Meets or Applicable-Does Not Meet, together with the compliance report, are treated as Controlled Unclassified Information and made available to authorizing officials on request for risk assessment purposes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.