The organization has to name the interested parties that bear on the records system and decide which of their needs become requirements it will meet. Interested parties can include regulators, courts, clients, employees, auditors, archivists, successors and the public. For each one the organization decides whether the need is mandatory, contractual or voluntary, and records the decision where the system can act on it. The clause does not require a document, but the requirements it produces have to be visible in 4.1.2 and in the controls.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.