The Statement of Applicability is thin on the reasons for including three controls
Description
The lead auditor of the Stage 1 audit read the Statement of Applicability and found that three controls are marked as included without a reason that a reader can follow. The text names the control and the Risk, but not why the control is needed in this organisation. Stage 2 will test the Statement against the Risk treatment, so the reasons must be complete by then.
Lotte van Dijk
·
I wrote down why the service desk tools are in scope, so the reasons for two of the three controls are done.
The third one is yours, @Sam de Vries, because it follows from the risk assessment.