The ISMS holds the documented information ISO/IEC 27001 itself calls for plus whatever else the organization decides it needs for the ISMS to be effective; how much depends on the organization's size and activities, how complex its processes and their interactions are, and how competent its people are. Held link: the 27003 introduction explains that for activities with no explicit documentation requirement, documentation is needed only as far as, and in whatever form, the organization decides under 7.5.1 b). Implementation points (general practice): keep an index of what 27001 requires (scope, policy, risk assessment and treatment processes, Statement of Applicability, objectives, competence evidence, operational records, assessment and treatment results, monitoring, audit and review results, nonconformities and corrective actions) and add only what operation needs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.