A STIG provides configurable operational security guidance for products being used by the DOD and does not equate to DOD approval for the procurement or use of the product. Authorizing officials determine product use and approval under DOD policy through RMF risk acceptance, drawing on NIAP evaluation for national security systems under CNSSP 11, NIST CMVP validation of cryptographic modules under federal and DOD mandated standards and, for unified capabilities, the DOD UC Approved Products List under DODI 8100.04. AOs may request the vendor's confidential STIG documentation for product evaluation and RMF purposes from the DISA STIG support desk; it is not published, to protect proprietary information.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.