The IAC cybersecurity plan must provide governance processes through which the organisation's exposure on regulatory, legal, environmental and operational fronts feeds into how IAC cyber risk is managed; measure the performance of the IAC cybersecurity program, address deficiencies and update the policy and plan to reflect corrections; and be reviewed at a defined frequency and at least every 36 months (every 24 months for any organisation with an IAC cyber environment classified above impact level I1).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.