Assign topic to the user
The purpose of control A.12.1.1 is to make it clear that all structured activities for any control from section A.12 need to be documented.
To use example of control A.12.1.2 (Change management) - if you have any kind of established process for managing changes for your operational systems, then you must document them (e.g. in the form of a procedure) because of control A.12.1.1; if you have only some unstructured activities for A.12.1.2, then you do not need to document them.
So i this case is it ok to just say yes in the SOA, because i will havesome documented procedures, and for justification I will namethe procedures in the SoA? no need to wite a more specific doc regarding 12.1.1?
As always thank you, you guys are the best and templates very helpful
Comment as guest or Sign in
Apr 20, 2020