No baseline requirement; at the Enhanced Profile and above the plan must require an IAC resiliency plan for critical services, built on risk, that manages the resiliency posture of the essential functions needed to deliver critical services, identifies every operating state of those functions (for example normal, diminished, under attack, stabilisation and recovery), sets consistent criteria for how much disruption each function can tolerate, and defines risk-based resiliency requirements for every identified operating state.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.