Are there 12 or 20 additional requirements in 252.204-7012? I only count 12, but some of the webinars (and supply chain questionairs) are calling out 20. Do some come from another source? like 800-53.

Are there any assessment objectives defined for these additional requirements, if so where? 171a?