The auditor examines the documented ISMS scope: that it was set considering the 4.1 issues, the 4.2 requirements and the interfaces and dependencies with activities of other organizations, that it is available as documented information, that it is consistent with the certification or audit scope, and that exclusions do not remove interfaces through which information in scope is exposed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.