Scope

The scope of this SoA includes all processes, technology, and locations of AppCan Ltd, unless explicitly stated otherwise.

Risk Assessment

The risk assessment process has identified several risks to the confidentiality, integrity, and availability of information within the scope. These risks have been evaluated based on their potential impact and likelihood of occurrence.

Control Selection

The following controls have been selected from Annex A to mitigate the identified risks:

1. A.5: Information security policies
2. A.6: Organization of information security
3. A.7: Human resource security
4. A.8: Asset management
5. A.9: Access control
6. A.10: Cryptography
7. A.11: Physical and environmental security
8. A.12: Operations security
9. A.13: Communications security
10. A.14: System acquisition, development and maintenance
11. A.15: Supplier relationships
12. A.16: Information security incident management
13. A.17: Information security aspects of business continuity management
14. A.18: Compliance