ISO 19011:2018, 6.4.5 is followed (methods follow where, when and how the information can be accessed, physical or virtual, and may need to change during the audit), and where classification or sensitivity keeps some audit evidence from the team during the audit, the lead auditor should judge how far this lowers confidence in the findings and conclusion and say so in the report, without revealing anything sensitive about the evidence that was withheld.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.