Non-CSP DoD contractors, Defense Industrial Base partners and DoD Component mission partners outside the .mil domain follow the mission owner guidance of the SRG when they put DoD data in a cloud, select the impact level from the DoD data processed, use only CSOs with a DoD PA at that level (Level 4 CSOs not dedicated to DoD, so they remain reachable from their own networks), protect data in transit with encrypted trusted communications, and comply with NIST SP 800-171 and the DFARS clauses for unclassified controlled information. DoD test and development in cloud infrastructure is categorised under DoD rules and placed in T&D zones: Zone A (application test) and Zone B (development) are protected and monitored by a CSSP, STIGed and behind their own firewalls, accessed via VPN from STIGed government furnished equipment, Zones C and D have lighter requirements but still a CSSP relationship, and Internet connections end at the T&D DMZ, where traffic is inspected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.