Ctrl + K
CM
Compliance ManagerAdministrator
STATEMENT OF APPLICABILITY
Annex A Control Applicability Management
24 May 2024 256709:32 AM
Total Controls
114
100% of Annex A
Applicable Controls
87
76.3% of total
Not Applicable Controls
27
23.7% of total
Implemented
58
66.7% of applicable
Partially Implemented
19
21.8% of applicable
Compliance Coverage
78.2%
6.4% vs last review
1.Control Applicability Summary
- Applicable87 (76.3%)
- Not Applicable27 (23.7%)
2.Implementation Status (Applicable Controls)
- Implemented58 (66.7%)
- Partially Implemented19 (21.8%)
- Not Implemented10 (11.5%)
3.Annex A Domain Performance
A.5
Org. Controls
86%
18 / 21
A.6
People Controls
81%
13 / 16
A.7
Physical Controls
92%
14 / 15
A.8
Technological Controls
75%
42 / 56
A.5
Supplier Controls
80%
8 / 10
4.Control Coverage Trend
Compliance Coverage (%)
5.Top Exceptions (Not Applicable Controls)
| Control ID | Control Name | Reason |
|---|---|---|
| A.7.3.1 | Physical security perimeter | Outsourced data centers provide perimeter security |
| A.7.3.2 | Physical entry controls | No physical entry to data centers |
| A.8.15.2 | Redundancy | Business continuity managed by cloud provider |
| A.8.16.1 | Monitoring activities | Covered under service provider monitoring |
| A.5.30 | ICT readiness for business continuity | Not applicable to service-based delivery model |
6.SoA Overview
Last Review Date
24 May 2024
Next Review Date
24 Nov 2024 (in 6 months)
Review Owner
Jane Smith
Approval Status
Approved
Approved By
David Johnson
Approved On
24 May 2024
7.Annex A Controls
114 controls
| Control ID | Control Name | Applicability | Justification | Owner | Implementation Status | Evidence | Last Review | Actions |
|---|---|---|---|---|---|---|---|---|
| A.5.1 | Policies for information security | Applicable | Relevant to organizational ISMS | Jane Smith | Implemented | 3 | 24 May 2024 | |
| A.5.2 | Information security roles and responsibilities | Applicable | Relevant to organizational ISMS | Michael Brown | Implemented | 2 | 24 May 2024 | |
| A.5.3 | Segregation of duties | Applicable | Prevents fraud and error | Sarah Wilson | Partially Implemented | 2 | 24 May 2024 | |
| A.5.4 | Management responsibilities | Applicable | Required for governance oversight | Jane Smith | Implemented | 4 | 24 May 2024 | |
| A.5.5 | Contact with authorities | Not Applicable | Not applicable to our business model | Michael Brown | N/A | — | 24 May 2024 |
Showing 1 to 5 of 114 controls
…