Skip to main content
ISMS Assistant · Risk treatment

Statement of Applicability & risk treatment

Updated on 4 min Pro plan Open in Cenedril

Goal Decide a treatment option for every prioritised risk, enable and assign the matching Annex A controls, and generate the Statement of Applicability (SoA) from them.

In the ISMS Assistant you treat each prioritised risk by opening Risk Treatment, choosing one of the four options, then enabling and assigning the matching Annex A controls on the Risk Controls page. From those decisions Cenedril generates the Statement of Applicability (SoA) at the end of the chapter, recording for each of the 93 controls whether it is applicable or excluded. The SoA is one of the mandatory audit documents and is then available as a record in Documentation.

Walk through the treatment options

Open Risk Treatment

In the ISMS Assistant open the Risk Treatment chapter. The entry page shows the four treatment options: Avoidance, Retention, Modification (Controls) and Sharing. The assistant guides you through all four across the following pages.

The entry page shows the four treatment options: avoidance, retention, modification and sharing.

Decide avoidance and retention

On the Risk Avoidance page you mark the scenarios whose underlying activity will be given up. On Risk Retention you record which risks already sit at an acceptable level and will be knowingly carried. These scenarios are then excluded from the controls page.

Enable and assign controls

Open Risk Controls

Switch to the Risk Controls page. It shows the 93 Annex A controls grouped into the four themes Organizational, People, Physical and Technological. Four stats cards at the top summarise the state: enabled controls, recommended among them, and the most and least covered scenario.

The stats cards show, among other things, the least covered scenario, a good place to start the work.

Work through the recommended controls first

Turn on the Show recommended only filter to see the controls Cenedril derives from your scenarios first. Recommended controls carry an amber Recommended badge. Use the search box and the theme and CIA filters (C, I, A) to narrow the list further.

Expand and enable a control

Click a control to expand it. You see the short summary, the associated threats and the execution criteria. Toggle the switch on the right to enable the control. On enabling, Cenedril pre-assigns the recommended scenarios.

When expanded, you select the execution criteria and assign the covered scenarios to the control under “Assign to risks”.

Pick execution criteria and assign risks

Under the description blocks, tick the execution criteria you commit to. The depth follows the risk level of the covered scenarios. Then, under Assign to risks, mark every scenario the control covers. Make sure every enabled control carries at least one assigned risk.

Justify exclusions and save

For controls you do not enable, pick a category in the Exclusion reason field (such as Not applicable, Resource constraints or Compensating control exists) and add a note where useful. Save your work with Save as Draft or finish the page with Save & Continue.

Review the Statement of Applicability

Open the Statement of Applicability

At the end of the chapter the Statement of Applicability (SoA) page opens. It is read-only and generated automatically from your control decisions. Two counters at the top show how many controls are Applicable and how many are Not Applicable.

The SoA lists every Annex A control with status, assigned risks, excluded criteria and exclusion reason.

Check the table and the exclusions

The table shows, per control, the columns Annex A, Name, Status, Assigned Risks, Excluded Criteria and Exclusion Reason. Use the All, Applicable and Not Applicable filters to confirm that every applicable control has an assigned risk and every excluded one carries a reason. Clicking the control icon opens the detail view.

The SoA itself is stored as a record under Documentation, where it can be versioned and formally approved. Without an approved SoA, the risk treatment counts as incomplete from an audit perspective.

Result: every prioritised risk carries a treatment decision, the applicable controls are enabled and assigned to their scenarios, and the Statement of Applicability lists all 93 controls in full with status and reason. The next chapter turns these decisions into security objectives and an implementation plan.

Frequently asked questions

What are the four treatment options?

Avoidance (give up the underlying activity), retention (knowingly carry a risk that is already acceptable), modification (apply controls to lower likelihood or impact) and sharing (transfer part of the risk to a third party via insurance, outsourcing or contract). The assistant walks you through all four in turn.

Do I have to decide each of the 93 controls one by one?

Based on the scenarios from the previous chapters, Cenedril flags recommended controls with an amber “Recommended” badge. Use the “Show recommended only” filter to work through that selection first. The remaining controls each need either an activation or an exclusion reason so the SoA becomes complete.

Why should every enabled control have an assigned risk?

An enabled control with no assigned scenario shows up as a blank in the Statement of Applicability, and the later implementation plan never learns what it spends effort on. So whenever you enable a control, assign it at least one scenario in the assignment list.

Can I edit the Statement of Applicability myself?

The SoA page in the assistant is read-only. Cenedril generates the statement automatically from your control decisions. The finished document is stored as a record under Documentation, where it can be versioned and formally approved.

What happens to excluded controls?

For each control you do not enable, you choose an exclusion reason (such as “Not applicable”, “Resource constraints” or “Compensating control exists”) and can add a note. These appear in the SoA under the “Exclusion Reason” column and are checked during an audit.