ISO 19011:2018, 5.5.2 is followed, and an ISMS audit may aim to judge whether the ISMS properly recognises and deals with information security requirements, and to establish how far the information security controls conform to the ISMS's procedures and requirements; when setting the scope, the information security risks should be considered along with the relevant risks and opportunities bearing on the ISMS of the auditee and the audit client; and the criteria may take in the auditee's information security policy and objectives, its policies and procedures, its contractual and other requirements, its risk criteria, its processes for assessing and for treating risk, the Statement of Applicability including any necessary controls, sector-specific or otherwise, why each control is included, whether it is in place, and why any Annex A control of ISO/IEC 27001:2013 is excluded, how controls that treat risks are defined, the methods and criteria used to monitor, measure, analyse and evaluate how the ISMS performs on information security and how effective it is, and information security requirements that a customer sets or that a supplier or outsourcer applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.