Mid-build and stalled on the SoA. Some controls clearly don’t apply to us (we don’t do any software development, for example), but I’m nervous about writing “not applicable”. Will an auditor push back? What does a good justification actually look like?
“Not applicable” is a perfectly normal SoA answer, and auditors see it constantly. The test is whether the reason holds up. “Not applicable: the organisation does not develop software, so secure-development controls (A.8.25–A.8.29) are out of scope” is fine. “Not applicable” with no reason is not. Tie each exclusion to a fact about your business or your risk assessment, keep it to a sentence, and you’re done. The controls that do apply are the ones your risks point at. Build those, justify the rest out, and the wall of 93 becomes manageable.