Academy module 4 · ISO/IEC 27001 · Lesson 4 of 8
Select treatment and explain applicability
About 12 minutes · Introductory draft · Checked 2026-10-24
AI-authored and AI editorially reviewed; independent review pending. Read course scope and remaining gaps.
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: The applicability record explains control decisions, not just selected boxes.
Explore the anchors
Choose a response to the assessed exposure.
Concept matching activity
Match this task or description to its concept:
Explain necessary controls and exclusions.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What you will learn
- Choose a response to the assessed exposure.
- Explain necessary controls and exclusions.
- Obtain an authorized decision after treatment.
Concepts and distinctions
Risk treatment can reduce exposure, avoid an activity, share specified consequences or accept residual risk within authority. Controls should follow the treatment decision and the organization’s requirements. A reference control catalogue is a useful completeness check, but adopting every control without considering purpose can produce expensive documentation with little operational value.
The statement of applicability explains the organization’s control choices and their implementation position. It is connected to risk treatment and other applicable requirements. An excluded reference control needs a justified decision; a selected control needs more than a tick in a spreadsheet. Organizations may need safeguards beyond a reference catalogue. Consult the licensed standard for the exact required content and the current reference-control structure.
Apply the process and collect evidence
Link each treatment to a risk owner, delivery owner, resources, due dates and expected evidence. Check that the applicability record and operating reality agree. Review exceptions and unfinished controls explicitly rather than describing them as complete. Reassess residual risk after evidence of implementation and authorize the remaining exposure at the appropriate level.
Link risks, treatment, applicability and control evidence
Trace a treatment decision from the risk description to the chosen safeguard, responsible owner, implementation evidence and residual-risk decision. A Statement of Applicability explains the necessary controls and their inclusion, exclusion and implementation status against the applicable reference framework. It is not a list of products to purchase. Use the licensed standard for exact requirements and control references; this academy does not reproduce the Annex A control set.
Build an audit test from a requirement and an observable outcome. For example, the organization requires approval before privileged access is activated. Identify the population of relevant access changes, select a justified sample across teams and dates, compare request approvals with activation timestamps, and record exceptions. A sample of five cannot prove all changes complied. Keep the population definition, selection rationale, evidence references and limitations with the conclusion so another reviewer can follow the reasoning.
Work through a scenario
Fictional facts for learning. This exercise is not scored.
A team marks backup recovery as implemented because a policy exists, although no restoration has been attempted. The statement of applicability is presented as proof that the risk is resolved.
Compare your reasoning
The policy supports design intent but does not prove recoverability. Record the actual implementation position, test restoration against service objectives and reassess residual risk. The applicability record communicates control decisions; it cannot manufacture evidence of operation.
Remember
- The applicability record explains control decisions, not just selected boxes.
- Choose a response to the assessed exposure.
- Obtain an authorized decision after treatment.
Orientation and further reading
- ISO: ISO/IEC 27001:2022 with Amd 1:2024 context
- ISO: guidance for auditing management systems (public overview)
Original examples and explanations. Background references do not establish complete exam coverage.
Try ISO/IEC 27001 practice questions · Report a content correction