No baseline requirement; at the Enhanced Profile and above the plan must require that risk management processes record, in the risk management strategy, the organisation's critical infrastructure role and any other risk specific to its sector, that the role is built into the risk tolerance posture, that it is weighed in risk management decisions (likelihood and impact estimates, criticality rating, response actions and their priority) and in defining roles and assigning responsibilities, and that awareness training explains the role to staff.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.