ISO 19011:2018, 5.4.3 is followed, and the extent of an ISMS audit programme can include the size of the ISMS (how many people work under the organization's control, its relationships with contractors and interested parties relevant to the ISMS, how many information systems and how many sites it has), how complex the ISMS is, including how many processes and activities there are, how critical they are and how sites differ, how much the identified information security risks matter to the business, how much the risks and opportunities found when planning the ISMS matter, the importance of preserving confidentiality, integrity and availability within the scope, the complexity of the information systems and technology audited, and the number of similar sites; which areas get closer examination should depend on business requirements and on how significant the information security risks are. ISO/IEC 27006, together with IAF MD 1, gives audit-time and multi-site sampling guidance that applies only to certification audits.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.