OMB requires agencies to comply with the NIST guidance issued under 4(e) for software procured after the date of the order; agencies may request an extension, considered case by case and only with a plan to meet the requirements (4(l)), or a waiver, granted only in exceptional circumstances, for a limited time and with a risk mitigation plan (4(m)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.