Conformity, assurance & SoA
Conformity labels
Section titled “Conformity labels”| Label | Meaning |
|---|---|
| Not assessed | No assessor conclusion has been recorded |
| Conformity supported | Current evidence and testing support the atomic requirement within scope |
| Partial evidence | Some relevant practice or evidence exists, but the requirement is not fully supported |
| Nonconformity | The requirement is not met or current adverse evidence contradicts conformity |
“Partial evidence” is not a favourable substitute for nonconformity. Use it where evidence is incomplete or mixed and record the resulting gap. Where the requirement itself is not fulfilled, record the nonconformity.
Assurance depth
Section titled “Assurance depth”| Depth | Meaning |
|---|---|
| 0 — Unverified | No objective evidence has been evaluated |
| 1 — Documented | Approved documented information has been inspected |
| 2 — Implemented | Implementation has been sampled in operation |
| 3 — Assured | Operating effectiveness has been independently verified |
Conformity answers what the assessor concludes. Assurance answers how strongly that conclusion has been verified.
Examples:
- Conformity supported + Documented: design appears suitable, but operation has not been sampled.
- Conformity supported + Assured: suitable evidence and independent effectiveness verification.
- Nonconformity + Assured: strong evidence confirms the requirement is not met.
Do not lower assurance to hide an adverse outcome.
Statement of Applicability labels
Section titled “Statement of Applicability labels”| Label | Meaning |
|---|---|
| Applicability undetermined | The Annex A control has not received a defensible decision |
| Applicable | The control is selected as necessary treatment or otherwise required |
| Not applicable — justification required | A documented, risk-linked basis supports exclusion |
For a not-applicable decision, explain:
- The exact scope and risk basis.
- Why the control is unnecessary.
- Relevant legal, contractual and interested-party requirements.
- Any alternative treatment.
- Decision owner and review trigger.
An unsupported exclusion remains a readiness gap.
Coverage and readiness
Section titled “Coverage and readiness”Coverage shows how much of the assessment has a recorded decision. It does not show that the AIMS conforms.
A whole-scope conclusion requires, at minimum:
- Complete assessment coverage.
- Complete Annex A applicability decisions.
- Assessment of every applicable Annex A control.
- Valid exclusion justifications.
- Rationale for requirement decisions.
Readiness can still be negative after completeness is achieved. A complete assessment with nonconformities is more defensible than an incomplete assessment with a high headline percentage.
Decision examples
Section titled “Decision examples”Supported and implemented
Section titled “Supported and implemented”The approved AI policy applies across the AIMS scope; sampled teams use the current version; communications and awareness records are current; exceptions are controlled. Record Conformity supported and at least Implemented, subject to the strength of verification.
Documented but not operating
Section titled “Documented but not operating”A risk-treatment process exists but sampled projects did not use it. Record Nonconformity or Partial evidence according to the exact atomic requirement, and do not exceed Documented assurance.
Annex A exclusion
Section titled “Annex A exclusion”A control is outside the approved treatment because the relevant capability does not exist within scope. Record the technical and risk basis, alternative safeguards if relevant, owner and change trigger. Reassess if the capability is introduced.