No baseline requirement; at the Enhanced Profile and above the plan must require that the organisation's place in the critical infrastructure supply chain shapes its risk tolerance posture, is included in risk management decisions (likelihood and impact estimates, criticality rating, response actions and their priority) and in defining roles and assigning responsibilities, and is explained to staff through awareness training.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.