The NIST Director develops and revises, as needed, standards for security automation, their reference materials and protocols, and checklists of settings and options that minimise the security risk of every hardware or software product and security tool in wide, or likely wide, federal use, so that continuous monitoring across government can rest on standardised, interoperable technology and architecture; priorities are set by the security risk of the system, the number of agencies using it, the usefulness to agency users, the effectiveness in enabling continuous monitoring and other factors; systems may be excluded for infrequent use, obsolescence or impracticability; agencies are informed of what is available; and the existence of a checklist does not oblige an agency to adopt its settings, condition procurement or deployment, imply endorsement, or bar an agency from using systems without one.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.