The organization has to provide records systems that keep records authentic, reliable, usable and protected for as long as they are needed. The annex frames the system requirements around integrity and security, the technologies chosen, an inventory of the systems in scope, documentation of how they work, availability, integrity, monitoring and access. The point is not to buy a particular product but to show that the chosen systems can carry the records requirements through technology change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.