Gold criterion crypto_used_network (MUST; group Security, Use basic good cryptographic practices). Criterion text: The software produced by the project MUST support secure protocols for all of its network communications, such as SSHv2 or later, TLS1.2 or later (HTTPS), IPsec, SFTP, and SNMPv3. Insecure protocols such as FTP, HTTP, telnet, SSLv3 or earlier, and SSHv1 MUST be disabled by default, and only enabled if the user specifically configures it. If the software produced by the project does not support network communications, select "not applicable" (N/A). This raises the silver criterion of the same name (there SHOULD) to MUST at the gold level.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.