Mission owners secure every system and application they build on IaaS or PaaS, at any level, with each DoD SRG and STIG that applies, and CSPs apply the relevant SRGs and STIGs (or equivalents DoD accepts) on dedicated infrastructure that serves only DoD tenants; otherwise CSOs are assessed under the FedRAMP configuration management control CM-6 against the CSP's own benchmarks (such as CIS or vendor hardening guides). DoD's own policy, guidance and operating constraints, CYBERCOM direction included, are followed where they apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.