Baseline: establish and distribute cybersecurity policies, plans, processes and supporting procedures commensurate with the regulatory, risk, legal and operational environment, and review them at least every 36 months or on significant organizational or technological change, updating as necessary. Enhanced: review them at least every 12 months or on significant organizational change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.