Statement of applicability
6 skills in this category.
- Applicability status reconciliationUse this skill when the implementation status column of a statement of applicability may not match reality, and the team asks "is our SoA accurate", "check the implemented column", "do we have…
- Control owner RACIUse this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who…
- Exclusion justification reviewUse this skill when a statement of applicability already exists and the team wants its exclusions to survive the audit, and asks "review our SoA exclusions", "is this a valid justification", "can we…
- Privacy and AI control applicabilityUse this skill when a company with a security applicability statement extends its management system to privacy or to AI, and asks "extend our SoA for privacy", "which privacy controls apply to a…
- Risk to control traceability checkUse this skill when the risk register and the statement of applicability were written separately and may not agree, and the team asks "do our risks link to our controls", "traceability between risk…
- Statement of applicability first draftUse this skill when a company has a risk assessment and treatment plan and now needs its first statement of applicability, and asks "build our SoA", "draft the statement of applicability", "which…