DISA accepts no liability for the consequences of applying specific configuration settings and implies no warranty that applying every configuration makes a system fully secure. Settings are to be evaluated in a local, representative test environment before implementation in production, especially with large user populations, because failure to test may lose required functionality; evaluating the risks and benefits to the system's circumstances is the system owner's responsibility, and the evaluated risk of not applying a specified setting must be approved by the responsible authorizing official. Organisations outside the DOD may use the guidance but must ensure all applicable guidance is applied at both the device hardening and the architectural level, since some settings are not configurable outside the DOD architecture.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.