The organization has to consider the issues from 4.1 and the requirements from 4.2, decide which risks and opportunities need action, plan the action, integrate it into the records processes and then check whether it worked. In records terms the risks are loss, alteration, unauthorized access, unavailability, premature destruction, failure to capture and loss of meaning over time; the opportunities are better evidence, lower cost, faster retrieval and reusable information. The output has to be specific enough to change a control.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.