Each STIG version is released by a memorandum for distribution signed by the DISA Risk Management Executive and Authorizing Official, citing DODI 8500.01, naming the STIG (and any STIGs it includes, as the REL LAN STIG Version 2 includes the REL Embedded LAN and REL In-Country LAN STIGs), releasing it for immediate use, stating where it is available and naming the STIG support desk as the point of contact; where the DISA AO limits a product's use to certain environments or requires specific mitigations, the restrictions are annotated in the signature memo, and a STIG's revision history records each version and release with its changes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.