Evidence per group, and a control that applies to one group only

Bakkerij De Testoven has two sites, Gent and Brugge. The anti-virus settings the owner uploads come from the devices in Gent. In Brugge the landlord manages the devices.

1. Open the control. Under the evidence, click the small target icon next to the evidence. When you add new evidence, the same question is in the form: Which groups does this evidence cover?
2. Pick Only for these groups and tick Devices Gent.
3. Click Save. The evidence now shows for Devices Gent.

Evidence without a group counts for everything the control applies to, as before. This choice only says what the evidence covers. It does not change what the control applies to.

Under Applies to the control says which part has the evidence and which part does not: "the evidence for ... only covers Devices Gent. It is missing for Devices Brugge." The Brugge row fails with "no evidence for ...". The requirement in the evidence list says "Missing for Devices Brugge".

Two buttons follow. Add evidence for Devices Brugge opens the form with Brugge already ticked. Does not apply to Devices Brugge? Limit the control opens the window below.

Is someone else in charge of the devices, such as a landlord? Then the devices usually still fall under the control: ask that party for evidence and add it for that group. Limit the control only when it truly does not apply there.

1. Under Applies to, click Limit to a group.
2. Tick one or more groups. The rest falls outside the control.
3. Why? Required. The auditor reads this reason.
4. Review on: 12 months by default, at most 3 years ahead.
5. Click Save.

The control then shows one line: "Applies only to Devices Gent (2 outside it)", the reason, the review date, and who recorded it and when. Rows outside the group are grey, Excepted, never green.

On that date the control applies to everything again. A month before, a question appears in To do. To keep the limit, click Renew and save it again with a new date. To end it now, click Apply to everything again.

The framework decides what a control is about, for example only computers. You can narrow that, with a reason. You cannot widen it: the auditor checks the control against its own text. Does a control seem to be about the wrong things? Tell your IT partner.

The Statement of Applicability names the limit with its reason. The audit bundle lists it in the exceptions file as "applies_only", with the reason, the review date, who and when.

Tying evidence to a group: everyone who may add or change evidence, so not read-only members. Limiting a control to a group: owners, administrators and members who may manage the register. Everyone else sees the limit and the gaps, without the buttons.