ISO 19011:2018, 5.2 is followed (objectives that direct planning and conduct, consistent with the audit client's strategy and the ISMS policy and objectives), and ISMS-specific considerations for determining them can include the identified information security requirements, what ISO/IEC 27001 requires, how well the auditee performs as shown by how often information security events and incidents occur and the effectiveness of the ISMS (ISO/IEC 27004 gives more on performance measurement), and information security risks facing the audit client and the auditee. Example ISMS objectives: showing that legal, contractual and other requirements, and what they mean for security, are met; obtaining and maintaining confidence in the auditee's risk management capability; judging how well the actions on information security risks and opportunities work.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.