EXAM-002 - Statement of Applicability

Topic Summary

The Statement of Applicability explains which Annex A controls apply, which do not, why those decisions were made, and whether selected controls are implemented.

Key Concepts

• Built from risk assessment and risk treatment decisions.
• Must justify included and excluded controls.
• Supports audit traceability.
• Does not replace the risk assessment or risk treatment plan.

Common Exam Traps

• Treating the SoA as optional.
• Treating the SoA as the same thing as the risk register.
• Assuming excluded controls need no justification.

Related Notes

• Statement of Applicability
• Risk Assessment
• Annex A and the Statement of Applicability