OMB requires agencies to comply with NIST's guidance on security measures for critical software (4(i)); OMB M-21-30 (10 August 2021) directs agencies to identify all critical software in use or being acquired within 60 days and to implement NIST's security measures for the initial-phase categories within one year, and for each later phase within a year of NIST's update.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.