Requirements & SoA
Measures and internal controls as evidence per requirement.
FEATURES · MEASURES & INTERNAL CONTROLS
Implement, evidence, review regularly.
Measures have responsible people and due dates, recurring tasks a fixed schedule with evidence for every execution. Where a requirement cannot be met, there is a time-limited, approved exception.
WHAT YOU GET
- Measures with status, due dates and evidence
- Recurring measures and internal controls with an annual plan
- Result per execution: effective or deficient
- Exceptions with expiry date, risk and approval workflow
Measures with a clear status
Every measure moves through Planned, In progress and Implemented. Whoever reports it as implemented describes how, and attaches evidence if needed. Overdue measures are visible straight away.
- Responsible people and due dates
- Linked to risks and requirements
- Responsible people see the purpose, even without further permissions
Recurring measures
Tasks such as applying patches get a schedule. Every execution is recorded with a date and PDF evidence, and missed dates are visible straight away.
- Intervals from one month to five years
- Evidence per execution, unchangeable
- Task before the due date
Internal controls
Checks such as the quarterly review of access rights are kept as internal controls with an objective, execution and expected evidence. A deficiency leads to a corrective measure and, if needed, a follow-up review.
- Result effective or deficient
- Annual plan from the schedule
- Mapped to requirements and risks
Exceptions with an expiry date
An exception is a deliberate, time-limited deviation from a requirement. It needs a linked risk and only takes effect once the approval workflow is signed off and the risk is accepted.
- Valid until a set date, with a reminder before it expires
- Approval workflow per organisation
- Extended only through a new approval
Related
Risk management
Why a measure is needed.
Frequently asked questions
What is the difference between a measure and an internal control?
A measure changes something, for example a new firewall rule. An internal control checks regularly whether something works, for example whether the backup can be restored. Both can be linked to risks and requirements.
How long is an exception valid?
Until the date set when it was approved. Before it expires, the responsible people receive a reminder; it is extended only through a new approval.
How close are you to ISO/IEC 27001?
In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.