Where a requirement's status is Applicable-Does Not Meet the Mitigation field must be populated with a method for minimising the risk, which does not remove the requirement, followed by a summary of the effect on overall risk (the risk can be decreased to CAT II or III, the risk is fully mitigated, or the mitigation supports the security function but is not sufficient to reduce residual risk); where the vulnerability is fully mitigated by another STIG's check or by the underlying operating system, the mitigation says so and cites that STIG requirement by ID.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.