RM-10—Statement of Applicability

>Control Description

Management prepares a statement of applicability that includes control objectives, implemented controls, and business justification for excluded controls. Management aligns the statement of applicability with the results of the annual risk assessment.

Theme

Process

Type

Preventive

Policy/Standard

Risk Management Standard

>Implementation Guidance

1. Ensure that the statement of applicability (SOA) is approved by the management and in alignment with the outcomes of the annual risk assessment to ensure consistency and relevance.

>Testing Procedure

1. Inspect the organization's statement of applicability (SOA) and compares it with the result of the annual risk assessment. 2. Validate whether the statement of applicability is approved by management.