These activities all get possibility assessed (with your risk management tool) that may help you then identify what in the Annex A Management goals you might want to carry out, which without having getting far too specialized at this time, causes your Assertion of Applicability. Did I by now say http://shanednvbg.blogdigy.com/considerations-to-know-about-iso-27001-certified-auditor-9657892