Guest user Created: Jun 06, 2016 Last commented: Jun 06, 2016

Are the documents from Annex A mandatory?

Under the list of mandatory documents required to be ISO 27001:2013 certified you say documents from Annex A are mandatory only if there are risks which would require their implementation- So am i right to assume that technically these documents from annex A such as inventory of assets etc are not mandatory unless otherwise?

0 0

Assign topic to the user

Select user

Expert

Dejan Kosutic Jun 06, 2016

Answer: Basically you are right - if you do not select the control A.8.1.1 "Inventory of assets" as applicable (this is done in the Statement of Applicability), then you don't have to create the document for inventory of assets.

These articles will also help you:
- The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/

And this free online course will also describe you above mentioned logic, as well as describe the controls fro m the Annex A: ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

Quote

0 0

Comment as guest or Sign in

HTML tags are not allowed

Name *

Email *

I accept the Privacy and Terms

Notify me when someone replies

Jun 06, 2016

Expert Advice Community