The Application Security and Development STIG applies to all enterprise applications connected via the network, including desktop clients that connect to remote systems and HTML and browser-based applications built on Java, JavaScript, .NET, cloud, RESTful and SOA web services; it is a requirement for all DOD-developed, -architected and -administered enterprise applications and systems connected to DOD networks, is used for in-house development and for evaluating COTS, GOTS, open source and other third-party products (where some sections may need vendor discussion or public information), is not applied to scripts, firewalls or network devices with management interfaces where a product STIG or technology SRG exists, and is used with the Enclave, Network Infrastructure, Application Server, Database, Browser and Operating System STIGs; specific guidance for one technology does not exempt applications on other technologies from a requirement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.