What Auditors Can Learn From Your Statement of Applicability
Your security manager updates the risk register on Monday. By Wednesday, a developer has changed a cloud access policy. On Friday, someone uploads a revised security procedure, yet the Statement of Applicability still identifies the earlier version. Nothing dramatic has happened. Yet these small discrepancies can create serious difficulties when an ISO 27001 auditor starts