ISOISO 27001Certification and Audit ProcessEASYFree question
Why is the Statement of Applicability critical during the certification audit?
- A.It lists the audit findings and nonconformities, which the certification body must send to the accreditation body
- B.It records the agreed audit fee and schedule, but the auditor reviews it after the certificate is issued
- C.It describes the ISMS scope and interfaces, so the auditor uses it to choose which sites to visit
- D.It documents which controls are implemented and justified, providing the auditor with a map of the organization's control environment
Why D is correct
The SoA is critical as it documents applicable controls, their justification, implementation status, and exclusion justifications, serving as a key reference for auditors.
Know someone studying for ISO 27001? Send them this one.