For requirements with status Applicable-Inherently Meets the Artifact Description cites the documentary evidence showing how the product inherently meets the requirement; all self-certification claims must be accompanied by supporting vendor documentation that as a whole gives DISA reasonable assurance the requirement is met: a test report describing the procedures, results, tool versions and date; a published administrative manual or configuration guide explaining how compliance is achieved; an attestation from the product developer with a brief statement of the technical means; or steps to verify the product cannot be configured out of compliance. Blogs and email messages are not sufficient. DISA validates a cited manual for the specific product versions in scope, inspects a test report for the software version and procedure, and requires a Letter of Attestation where supporting evidence is not documented.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.