audit-labs/control-coverage

 1# Example scope / Statement of Applicability.
 2#
 3# `frameworks` selects which catalogs to evaluate. Each exclusion removes a
 4# control from the in-scope denominator and MUST carry a justification. `owners`
 5# is optional metadata that flows through to the SoA.
 6subject: Acme Production
 7frameworks: [SOC2, ISO]
 8
 9exclusions:
10  - control: ISO:A.7.1
11    reason: "Fully cloud-hosted; no physical premises are in scope for the ISMS."
12  - control: ISO:A.7.2
13    reason: "No physical premises — physical entry controls are not applicable."
14  - control: ISO:A.5.7
15    reason: "No formal threat-intelligence program; risk accepted by the CISO for 2026."
16
17# Drop whole categories/families at once. A SOC 2 report here covers Security and
18# Availability only, so the other three Trust Services categories are out of scope.
19exclude_families:
20  - {framework: SOC2, family: Confidentiality, reason: "Confidentiality category not in the SOC 2 audit scope."}
21  - {framework: SOC2, family: Processing Integrity, reason: "Processing Integrity category not in the SOC 2 audit scope."}
22  - {framework: SOC2, family: Privacy, reason: "Privacy category not in the SOC 2 audit scope."}
23
24owners:
25  SOC2:CC6.1: platform-team
26  SOC2:CC7.2: security-ops
27  ISO:A.5.17: identity-team