CSPs are able to receive, act on and report compliance with DoD warnings, tactical directives, orders and notifications (such as USCYBERCOM TASKORDs and CISA directives relayed by DoD); under continuous monitoring, high and critical findings are mitigated within 30 days and moderate findings within 90 days or carried on a POA&M with DISA acceptance; CSPs notify all affected mission owners and DISA of scheduled outages and changes (authorized service interruptions) in advance and on return to service, with outages affecting more than one mission environment coordinated; CSPs at Levels 2 to 5 use a DoD PKI or DoD-approved external PKI certificate for signed and encrypted defence communications; and CSPs and DoD share vulnerability and threat information under the agreed mechanisms.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.