The organization must work out which records it needs to show that it meets its contractual obligations for the processing it performs for a customer, and must keep those records up to date. It should recognise that some jurisdictions require records of, for example, the kinds of processing performed for each customer, any data sent on to a third country or an international organization, and an overall account of the technical and organizational safeguards in place.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.