Statement of Applicability (SoA)
A Statement of Applicability (SoA) is the mandatory ISO/IEC 27001 document that lists the Annex A controls, states which ones the organization applies and justifies the inclusion or exclusion of each. It is one of the first documents a certification auditor reviews, because it links the risk assessment to the controls actually implemented.
How TecnetOne handles it: Cybersecurity Compliance
SoA, ISO 27001 SoA, ISO 27001 statement of applicability, Annex A controls, ISMS documentation
Related terms
Cybersecurity maturity model
A cybersecurity maturity model is a scale that measures how established, documented and continuously improved an organization's security practices are, usually in levels that range from informal processes to measured and optimized ones. A maturity assessment shows where the company stands, compares it with a reference framework and helps prioritize the next step.
Virtual CISO (vCISO)
A virtual CISO (vCISO) is a service in which an outside specialist takes on the duties of a chief information security officer (CISO) on an hourly or subscription basis: strategy, policies, risk management and reporting to leadership. It is common in midsize companies that need that leadership for an audit or a customer requirement but cannot justify a full-time hire.
ISO 27017 and ISO 27018
ISO/IEC 27017 and ISO/IEC 27018 are international standards that extend the ISO/IEC 27002 controls to cloud services. ISO 27017 adds security controls for cloud providers and customers, while ISO 27018 focuses on protecting personal data when a public cloud provider processes it on behalf of a customer. Both are usually assessed alongside ISO/IEC 27001.
Risk appetite and tolerance
Risk appetite is the amount of risk an organization is willing to accept to pursue its objectives, set by senior management or the board. Risk tolerance is the acceptable variation from that level for a specific metric. For example, appetite may be low for customer data leaks, with a tolerance of only a few hours of downtime per year for the payment system.
Nonconformity
A nonconformity is the failure to meet a requirement of a standard, a regulation or an internal procedure, identified during an audit. In standards such as ISO/IEC 27001 it is usually graded as major, when it undermines the management system, or minor, when it is an isolated lapse, and it requires a root cause analysis and corrective action. For example, missing evidence of access reviews.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.