Free tool
Which Annex A controls can you exclude?
Your premises, where your systems run and who builds your software. The Annex A controls those facts let you exclude, with Statement of Applicability wording.
Suggested exclusions
Answer the three questions and the suggestions appear here.
A suggestion, not a decision: an exclusion holds only if your risk assessment agrees and the fact behind it stays true. Your answers stay in this browser.
Where do these suggestions come from?
From the same rules Noru applies when it suggests exclusions during onboarding: no premises of your own, no server rooms of your own, and no software development of your own each make a defined set of Annex A controls excludable. The check uses that rule set, unchanged.
Can we exclude a control just because the tool says so?
No. An exclusion holds when your risk assessment gives no reason to apply the control and the fact behind it is true. The tool tells you which exclusions those facts can support and gives the wording; your risk owners still decide, and the auditor checks the fact.
Why do some physical controls stay for a remote company?
Because the risks travel with the people. Laptops, phones, removable media, equipment at home and its disposal are still yours, so clear desk and screen, equipment siting, off-premises assets, storage media, maintenance and disposal usually stay in scope.
Trust, settled.
A self-check is a snapshot. Noru keeps the answer current, control by control.