A single SRG or STIG is not all-inclusive for a system: a system may include database, web server, DNS and other components, and compliance with all the SRGs and STIGs applicable to it is required. Where a product-specific STIG exists it is applied in place of the technology SRG; where none exists the SRG's general check and fix procedures are used. A STIG for a product installed on a base platform assumes the platform is compliant with its own STIG, so operating system, network, application server, database, browser and enclave STIGs are applied together, and a technology overview names the companion STIGs it expects.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.