Annex A Control Selection Cheatsheet
Use risk and requirement logic to select, exclude, and evidence Annex A controls.
What are the strongest reasons to select an Annex A control? Risk treatment, legal or contractual requirement, policy objective, or baseline safeguard for the scoped service. Selection should trace to a need, not to template inertia. Recall Applicable versus implemented Compare A control can be applicable but not fully implemented; that should drive treatment planning. A manager says: "Mark it not applicable so we do not have to gather evidence." Exclusion without rationale will fail once the risk or requirement is visible. Your line We can exclude it only if it does not apply to the scoped service, risk profile,…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in