ISOISO 27001Risk Assessment and TreatmentEASYFree question
An organization marks an Annex A control on encryption as 'not applicable' in its SoA. To remain conformant, what must accompany this designation?
- A.A signed waiver from the certification body
- B.A documented justification for the exclusion
- C.Proof that the control was once implemented and later removed
- D.Approval from every affected department head
Why B is correct
The SoA must include justification for excluding any Annex A control. The exclusion itself is permitted when the control is not relevant, but the reasoning must be documented and defensible.
Know someone studying for ISO 27001? Send them this one.