The Revised 508 Standards do not apply to ICT that an agency operates as part of a national security system as defined in 40 U.S.C. 11103(a).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.