Bluetooth devices must run version 4.1 or higher following NIST SP 800-121r2: Security Mode 4 at Level 4 (an authenticated link key over secure connections), AES-CCM encryption, the P-256 curve for link key generation under secure connections, Encryption Mode 3 so that every packet is encrypted, and for Bluetooth Low Energy version 4.2 or higher in LE Security Mode 1 Level 4. Organisations must use the strongest security mode their devices support.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.