DISA Security Technical Implementation Guides (STIGs) SRG-4: SRG-4 SRG compliance reporting: requirements a product cannot meet go to AOs as a CUI report

All technical NIST SP 800-53 requirements are considered while developing a STIG; those that are applicable and configurable are included in the published STIG, and a report marked CUI listing the items that did not meet requirements is available to component authorizing official personnel on request to the STIG support desk for risk assessment purposes. The published STIG therefore holds only the Applicable-Configurable requirements, and a system's residual risk from the product's unmet requirements is read from the compliance report, not from the STIG.