{{- if .CompanyHorizontalLogoBase64}} {{imgTag .CompanyHorizontalLogoBase64 "Company Logo" "company-logo"}} {{- end}}

State of Applicability

{{.Title}}

Classification CONFIDENTIAL
Approver {{.Approver}}
Version {{.Version}}
Published {{.PublishedAt.Format "January 2, 2006"}}
1. Purpose
This document provides a comprehensive overview of the state of applicability for controls within the organization. It serves as a record of which controls are applicable or not applicable to the organization, along with their relationships to regulatory requirements, contractual obligations, risk assessments, and best practices.
{{- if .FrameworkGroups}}

2. Controls

{{- range $group := .FrameworkGroups}} {{- range $group.Controls}} {{- end}} {{- end}}
Framework Control Applicability Justification Justification for inclusion
Regulatory Contractual Best Practice Risk Assessment
{{$group.FrameworkName}} {{.SectionTitle}}{{.Name}} {{- $state := boolToYesNo .Applicability}} {{- if eq $state "yes"}} Yes {{- else if eq $state "no"}} No {{- else}} - {{- end}} {{- if .Justification}} {{.Justification}} {{- else}} - {{- end}} {{boolToYesNoDash .Regulatory}} {{boolToYesNoDash .Contractual}} {{- if .Applicability}} {{- if and .Applicability .BestPractice}} Yes {{- else if .Applicability}} No {{- else}} - {{- end}} {{- else}} - {{- end}} {{boolToYesNoDash .RiskAssessment}}
{{- end}}

3. Annexes

3.1 Column Definitions
Framework
Control
Applicability
Justification
Justification for inclusion
For applicable controls, this section provides additional context on why the control is included, based on regulatory requirements, contractual obligations, best practices, or risk assessments.
Regulatory
  • Yes: The control is linked to one or more legal or regulatory obligations.
  • No: The control is not associated with any legal or regulatory obligations.
  • -: Not applicable (control is not applicable).
Contractual
  • Yes: The control is linked to one or more contractual obligations.
  • No: The control is not associated with any contractual obligations.
  • -: Not applicable (control is not applicable).
Best Practice
  • Yes: The control is designated as a best practice recommendation.
  • No: The control is not designated as a best practice.
  • -: Not applicable (control is not applicable).
Risk Assessment
  • Yes: The control is associated with one or more identified risks through risk mitigation measures.
  • No: The control is not currently associated with any identified risks.
  • -: Not applicable (control is not applicable).