The organization has to determine what resources the records system needs and provide them. Resources include people with the right skills, systems and storage, budget, time, expert advice and access to the business functions the system serves. The clause puts the duty on the organization rather than on top management alone, which means resource decisions at every level have to match the objectives and the risks the system is meant to control.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.