The policy must require that IAC cybersecurity risks are governed and managed, and the plan must require that IAC governance and risk management take account of how the enterprise governs and manages its own cybersecurity risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.