Assessing an application under the ASD STIG expects application documentation (the vendor's or developer's product documents and configuration and management instructions) and system documentation (design and architecture documents describing how the product is implemented in the enclave, with the servers, load balancers, gateways, firewalls and other components, deployment depictions, configuration details and the intentions behind functionality), together with the system security plan per NIST SP 800-18, the application configuration guide, the security classification guide under DOD Manuals 5200.01 Volume 1 and 5200.45, coding standards, vulnerability scan reports and automated code review results; the functionality review considers the type of data processed (classified, unclassified, publicly releasable, PII), network connections and access controls, data entry and egress points, and the application's authentication, access control and auditing mechanisms.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.