Guest post Created: Jan 12, 2016 Last commented: Jan 12, 2016

Clause to requires status of control in 27001:2013 SOA

I am not sure whether in the new 27001:2013 SOA really required status of each control instead of just yes or no in 2005; Where is the cause in standard state that we need to add "status of implementation" in 27001:2013 SOA? Thank you

0 0

Assign topic to the user

Select user

Guest

DejanK Jan 12, 2016

Chattavut,

ISO 27001:2013 defines Statement of Applicability in clause 6.1.3 d), and it requires that SoA should state for each control "whether they are implemented or not" - therefore, you need to document their status in SoA.

Quote

0 0

Comment as guest or Sign in

HTML tags are not allowed

Name *

Email *

I accept the Privacy and Terms

Notify me when someone replies

Jan 12, 2016

Expert Advice Community