While you are answering questions you might find that an answer is not applicable. There are two ways the platform caters for this scenario.
There are some cases where you can indicate that the entire control is not applicable.
For example you may be asked how you secure USB drives when being transported.
In the case where your organisation have blocked the use of all USB drives there will be an applicable response such as "Not applicable as the organisation does not use USB drives".
When you select not applicable a key finding statement is created that explains that the control is not applicable and the score and associated risks that may have otherwise been linked to this control will be removed.
There are some cases where there is a list of controls available for you to select from and not all controls are applicable.
For example you may be asked to select which physical controls you have in place and a list of 10 options appear. One of these options is "Mandatory visitor registration before entering premise" however, the in-scope building does not allow visitors. In this instance, you can select to de-scope the control.
When you select Toggle out-of-scope for this assessment the control is removed from the assessment, there is no key finding statements created, the score and associated risks that may have otherwise been linked to this control will be removed. Note: The de-scope feature is only available for a limited number of questions as more often than not a standard you are assessing your business against requires you to have control and descoping would mean no information would be gathered about that required control.
