Each SRG requirement is analysed against the product and given one of four statuses: Applicable-Configurable where the product requires configuration or policy settings to achieve compliance; Applicable-Inherently Meets where the product is compliant in its initial state and cannot be reconfigured to a noncompliant state; Applicable-Does Not Meet where there are no technical means to achieve compliance; and Not Applicable where the requirement addresses a capability or use case the product does not support (encryption of removable media on a product with no removable media, or an operational environment the product will not be placed in). The inability to meet an SRG requirement feeds residual risk decisions for information systems employing the product, and only Applicable-Configurable requirements are published in the STIG.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.