No baseline requirement; at the Enhanced Profile and above the plan must require that every staff member is screened, except where the law forbids it,, including identity validation and background checks, before physical or cyber access to the IAC cyber environment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.