The technical and institutional authorities for the requirements of this directive assess each project's mapping matrix and its tailoring by checking the accuracy of software classification against Appendix D, evaluating the matrix for commitments consistent with the class, confirming that requirements marked not applicable truly do not apply, judging whether the risks and mitigations behind requests for relief are reasonable, approving or disapproving relief within their scope, facilitating decisions that belong to a different authority, including the SAISO or delegate in software reviews so that cybersecurity is addressed throughout, and ensuring approved tailoring is recorded.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.