Parties within the DOD and federal computing environments obtain STIGs, SRGs and related security information from the DOD Cyber Exchange at cyber.mil; those without a Common Access Card with DOD certificates obtain the unclassified content from public.cyber.mil. Two compilations of the SRG-STIG library are posted: U_ files containing only publicly releasable STIGs and content, and CUI_ files that add STIGs designated Controlled Unclassified Information, downloadable only with a DOD PKI certificate, never released to individuals or organisations without CAC credentials except case by case with the information owner's approval through the STIG support desk, and handled under CUI dissemination rules. Compilations may be used and distributed like individually downloaded documents.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.