ISO 19011:2018, 5.1 is followed (the third edition removed the former 27007 text here): an ISMS audit programme is established covering ISO/IEC 27001 and any other criteria, separately or combined, with an extent based on the auditee's size and nature and on the nature, complexity, risks and opportunities and maturity of the ISMS, particular attention to multiple sites and outsourced functions, scaling down for small organizations, taking into account the organization's objectives, external and internal issues, interested-party needs and its information security and confidentiality requirements, with those managing it protecting the integrity of audits from undue influence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.