Every applicable requirement carries a Severity Category Code: CAT I for any vulnerability whose exploitation will directly and immediately result in loss of confidentiality, availability or integrity; CAT II for any vulnerability whose exploitation has a potential to result in such loss; CAT III for any vulnerability whose existence degrades measures to protect against such loss. The author may adjust the severity from the SRG within those definitions, DOD subject matter experts verify the value considering the impact of noncompliance in the product's security architecture and expected environment, Not Applicable requirements carry no severity, and the severity of an Applicable-Does Not Meet requirement reflects the risk before any mitigation. Severity codes are a measure used to assess a facility's or system's security posture.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.