ISO 19011:2018, 6.2.3 is followed (sufficient information, cooperation, time and resources), and before the audit begins, the auditee should be asked if any ISMS audit evidence will be withheld from review, for instance because it holds personally identifiable, confidential or sensitive information; whoever manages the audit programme then decides if a proper audit of the ISMS is possible without it and, if it is not, tells the auditee the audit must wait until access is given or other means are agreed; if the audit proceeds, the plan takes the access limitations into account.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.