LIVE VIRTUAL TRAININGS
Learn in small groups from top experts and real-life examples

Expert Advice Community

Guest

SOA; CONTROL APPLICABLE vs. CONTROL IMPLEMENTED?

  Quote
Guest
Guest user Created:   Jan 04, 2022 Last commented:   Jan 04, 2022

SOA; CONTROL APPLICABLE vs. CONTROL IMPLEMENTED?

1 - Can you help me explain the implementation of SoA? 2 - Is SoA acceptable if not all applicable controls are implemented? (control applicable) are not (control implemented)?
0 0

Assign topic to the user

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

Expert
Rhand Leal Jan 04, 2022

1 - Can you help me explain the implementation of SoA?

The implementation of SoA, i.e., of the controls identified as applicable, is made according to what is defined in the Risk Treatment Plan, which defines actions, responsible, and deadlines.

For example, if control A.12.3.1 Information backup is defined as applicable in the SoA, in the Risk Treatment Plan you will define activities like elaboration, approval, and publication of a Backup Policy, and the acquisition and implementation of a software solution to be implemented in your environment.

For further information, see:

2 - Is SoA acceptable if not all applicable controls are implemented? (control applicable) are not (control implemented)?

I’m assuming you are asking about SoA acceptance considering certification purposes.

Considering that, during a certification audit it can accept that certain controls stated in the SoA as applicable are not implemented if:

  • all the major risks are resolved before the certification
  • in the Risk Treatment Plan it is clearly defined that those controls will be implemented at a later date
  • the risk owners have accepted the risks related to controls that will be implemented later.
  • These materials will also help you regarding Risk Assessment and Treatment:

    Quote
    0 0

    Comment as guest or Sign in

    HTML tags are not allowed

    Jan 04, 2022

    Jan 04, 2022