The plan must require that the cybersecurity roles and responsibilities for every IAC cyber environment are written down, attached to roles and given to named people in the workforce and third-party stakeholders, with assignments aligned to the capability of the assigned personnel.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.