2Assess

ISO 27001Applicability Profile

ISO 42001Applicability Profile

Applicability Profile

Purpose

Statement of which controls apply, are excluded, or are treated—the Statement of Applicability.

Role

ISO/IEC 27001 Clause 6.1.3 and ISO/IEC 42001 Clause 6.1.3 require a Statement of Applicability: which Annex A controls are applicable, why, how they are implemented or excluded, and residual risk accepted. Gemara can list controls but not a formal applicability determination.

This page is a stub: fields, examples and schema are still to be specified.

Links upstream

• Stakeholder Requirement
• Risk Assessment
• AIMS Scope
• Control
• ISO/IEC 27001 Guidance Catalog

Links downstream

• Policy
• Management Review

Related factors

• Governance Is Composable
• Build a Governance Twin

References

• ISO/IEC 27001 Analysis — Clause 6.1.3
• ISO/IEC 42001 Analysis — Clause 6.1.3
• ISO/IEC 27001 Guidance Catalog (iso27001-6.1.3)