ISOISO 27001Risk Assessment and TreatmentEASYFree question
Which of the following is NOT a required element of the Statement of Applicability under ISO/IEC 27001:2022?
- A.Justification for the inclusion of necessary controls
- B.Whether the necessary controls are implemented
- C.Justification for exclusions of Annex A controls
- D.The annual budget allocated to each control
Why D is correct
The SoA must contain necessary controls, inclusion justifications, implementation status, and exclusion justifications. Budget figures are not a mandated SoA element, even though cost may inform treatment decisions elsewhere.
Know someone studying for ISO 27001? Send them this one.