How do we justify excluding an Annex A control?

Start

We want to mark an Annex A control as not applicable

Every one of the 93 controls stays in the Statement of Applicability with a Yes or No decision. A missing row is a finding. An exclusion is a decision you must be able to defend from your own risk assessment and scope. A Statement of Applicability with many exclusions is usually a sign that controls were dropped for convenience.

• Then: Are the risk assessment and the scope approved?

Decision

Are the risk assessment and the scope approved?

The Statement of Applicability records the result of risk treatment. It does not replace it. Controls are chosen to treat the risks the assessment found, so an exclusion decided before that assessment has nothing to rest on. If you are not sure the assessment is final, treat the answer as no.

• Yes: Check whether the control usually applies
• No, or not known: Finish the risk assessment first; do not work down the list

Outcome

Finish the risk assessment first; do not work down the list

Written before the risk assessment, the Statement of Applicability becomes an Annex A checklist that has to be rewritten. Its exclusions will have no reason an auditor can trace, which is a common first-certification failure.

Step

Check whether the control usually applies

Most controls apply to nearly every organisation, and excluding one of these will be challenged. The rest depend on scope, and each has a deciding question, such as whether you pay anyone outside the organisation to develop software for you. Answer that question for your own organisation.

• Then: Does a supplier carry out the control for you?

Decision

Does a supplier carry out the control for you?

Physical security at a cloud provider's data centre, or patching done by a managed service provider, is still needed. The provider carries it out. Excluding it tells the auditor you have not thought about where your data is.

• Yes, wholly or partly: Keep it applicable, delivered by the supplier
• No: Does a law, regulation or contract require it?

Outcome

Keep it applicable, delivered by the supplier

Record it as applicable, delivered by the supplier or by you and the supplier. Name the contract or the provider's certificate or assurance report as how it is implemented, and check the certificate covers the service you buy.

Decision

Does a law, regulation or contract require it?

A control can be needed because a law such as NIS2 or DORA, or a customer contract, requires it, whatever your own risk assessment says. Check the contracts and the legal register before deciding. If you do not know, treat the answer as yes until someone who does has checked.

• Yes, or not known: Keep it, citing the law or contract as the reason
• No: Why does the control not apply?

Outcome

Keep it, citing the law or contract as the reason

Choose 'Legal or regulatory' or 'Contractual' as the reason, and say whose requirement it is and where it is written. Never exclude a control the law requires. The certificate is evidence for a regulator; it is not compliance with the law.

Decision

Why does the control not apply?

There are three accepted reasons: the activity is not carried out within the scope, the activity sits outside the ISMS scope, or the risk assessment found no risk the control would treat. 'We have not done it yet' and 'it is too much work' are not reasons. A control that is not in place is applicable and not implemented.

• The activity does not happen in scope: State the fact about the scope that removes the activity
• It sits outside the ISMS scope: Point to the scope statement, and how the interface is controlled
• No risk in scope needs it: Cite the risk assessment that found no risk to treat
• It is not in place yet, or too costly: Do not exclude it: record it as applicable and plan the gap

Step

State the fact about the scope that removes the activity

Say what does not happen, and how you know. The pack's example excludes outsourced development because all software is written by the company's own staff. Check it is true in practice: a contractor writing one script would change the answer.

• Then: Write the fact, the link, and what would make you revisit it

Step

Point to the scope statement, and how the interface is controlled

Cite the scope statement, its version and the section that places the activity or site outside the ISMS. The scope statement itself must justify that boundary. Then say how the connection to it is controlled, for example through supplier controls.

• Then: Write the fact, the link, and what would make you revisit it

Step

Cite the risk assessment that found no risk to treat

Name the risk register and its version. The exclusion is only as good as the assessment behind it: when a new assessment is done, this decision is reviewed. Expect a strong challenge if the control is one that almost always applies.

• Then: Write the fact, the link, and what would make you revisit it

Outcome

Do not exclude it: record it as applicable and plan the gap

Mark it applicable with a status of Planned or Not implemented. Every applicable control that has not started needs a gap with an owner and a date in your remediation plan. 'Not in place yet' is not one of the exclusion reasons, and an exclusion an auditor cannot trace to the scope or the risk assessment will be challenged.

Step

Write the fact, the link, and what would make you revisit it

A defensible justification names the fact about the scope, links it to the risk assessment or scope statement, and says what would change the decision. The template flags anything under 12 words, and 'N/A', 'not applicable' or 'not relevant' on their own.

• Then: Could an auditor trace it to the scope or the risk assessment?

Decision

Could an auditor trace it to the scope or the risk assessment?

Read it as the certification body will at Stage 1. It challenges any exclusion it cannot trace to the risk assessment. Your internal auditor checks the same reasons when auditing risk treatment. If the justification rests on an opinion rather than a fact or a document, rewrite it.

• Yes: Have top management approve the decision
• No, or not sure: rewrite: Write the fact, the link, and what would make you revisit it (back to an earlier step)

Step

Have top management approve the decision

Top management approves the Statement of Applicability's decisions, not only the ISMS manager. Who that is depends on how you are governed: the board or a delegated board committee, the management board in a two-tier structure, or executive management where there is no board. Changing any Yes or No later needs a new approval.

• Then: Excluded, justified, and reviewed with the SoA

Outcome

Excluded, justified, and reviewed with the SoA

Review every decision when the risk assessment, the scope or the organisation changes, and at least every 12 months. Keep superseded versions. The certification body asks for the Statement of Applicability at Stage 1 and samples its controls at Stage 2.