Organizations select the controls their risk assessment calls for and justify every inclusion and exclusion in the Statement of Applicability. ISO/IEC 27002 gives implementation guidance for each control.
The Annex A guide covers the controls.
Read more
Related terms
- Statement of Applicability
- The Statement of Applicability is the mandatory ISO 27001 document listing which Annex A controls apply, which are excluded and why.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.
- Control mapping
- Control mapping is linking each control to every framework requirement it satisfies, so one control and its evidence serve several frameworks at once.