Providers should ask the vendors that implement their cryptographic modules to be transparent in change logs about changes to modules and their extent (FRR11), to promote update streams over validated module streams because pinning drags in outdated vulnerable dependencies across the operating system (FRR12), to test algorithms to NIST requirements through the CAVP Automated Cryptographic Validation Testing System (FRR13), and to resubmit modified modules for FIPS validation to maintain assurance (FRR14).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.