An organization has justified the exclusion of control 5.18 Access rights of ISO/IEC 27001 in the Statement of Applicability (SoA) as follows: "An access control reader is already installed at the main entrance of the building." Which statement is correct'

The justification provided is unacceptable because it fundamentally misinterprets the purpose of control 5.18. Control 5.18, "Access rights," requires a formal process for the entire lifecycle of managing access rights—including their provisioning, review, modification, and removal. The presence of a physical access reader at an entrance is a mechanism for enforcing physical access (related to control 7.2 Physical entry), but it does not address the procedural and management requirements of control 5.18. The justification confuses a technical enforcement mechanism with the overarching management process, thus failing to provide a valid reason for the control's exclusion.

A. This is incorrect. ISO/IEC 27001:2022, Clause 6.1.3 d), explicitly requires the Statement of Applicability (SoA) to contain the justification for any exclusions of controls from Annex A.
C. While it is true that control selection and exclusion must be based on risk assessment results, the more direct and specific error in this scenario is the justification's complete irrelevance to the control's purpose.

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 6.1.3 d): States the organization shall produce a Statement of Applicability that contains "the justification for any exclusions". This directly refutes option A.

Annex A, Control 5.18: The objective of this control is "to specify and use the full life cycle of management of access rights". The control text details requirements for a formal process for provisioning, reviewing, modifying, and removing access rights. This supports the reasoning that a physical reader does not fulfill the control's purpose, making option B correct.

2. PECB. (2022). ISO/IEC 27001:2022 Lead Implementer Training Course Material.

Module: Clause 6 Planning, Section: Information security risk treatment (6.1.3): The courseware explains that the justification for excluding an Annex A control in the SoA must be sound and logical. A common invalid justification is confusing one control's purpose with another's implementation, as demonstrated in the question. The justification must clearly state why the control is not applicable within the defined ISMS scope, based on the risk assessment.

3. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page.

Chapter 11, The Statement of Applicability (SoA): This guide emphasizes that the SoA is a pivotal document linking the risk assessment to the chosen controls. It clarifies that justifications for exclusion must be robust and auditable, explaining why a specific risk does not exist or is accepted, rendering the control unnecessary. A justification based on a misunderstanding of the control's intent would not be considered robust.