Top management must establish a records policy and keep it as documented information. The policy has to suit the organization's purpose, commit it to meeting applicable requirements and to continual improvement, and provide a framework for setting records objectives. It also has to be communicated inside the organization and be available to interested parties where that is appropriate. A policy that could be pasted into any organization proves nothing; the test is whether it changes decisions about capture, access, retention and disposal.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.