Input: all controls applicable to treatment (8.4). Action: produce the Statement of Applicability. Trigger: need to document the necessary controls, their justification and status. Output: the SoA. It contains at least the necessary controls, the justification for including them, whether they are implemented, and the justification for excluding Annex A controls. It is drawn from the risk assessment (necessary controls) and the treatment plan (controls planned); only controls identified in the assessment may appear, none can be added independently of it, and the SoA stays consistent with the controls the chosen options need. A single inclusion justification (found necessary in the risk assessment to reduce at least one risk to an acceptable level) can cover all controls, and status can be implemented, partially implemented or not implemented, per control or as one overall statement such as all controls implemented.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.