The plan must require that mission, objective and activity priorities are taken into decisions on defining roles and assigning responsibilities and in risk management decisions (impact calculation, criticality rating, risk response prioritisation), and that the IAC cybersecurity training program communicates those priorities.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.