DOD Instruction 8500.01 requires that all IT that receives, processes, stores, displays or transmits DOD information be configured consistent with DOD cybersecurity policies, standards and architectures, tasks DISA to develop and maintain CCIs, SRGs, STIGs and mobile code risk categories with NSA/CSS support and stakeholder input, using automation whenever possible, and tasks DOD component heads to ensure that all DOD IT under their purview complies with the applicable STIGs, security configuration guides and SRGs. Every SRG and STIG is issued under that authority, and each release memorandum from the DISA Risk Management Executive and Authorizing Official cites it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.