Marking a requirement not applicable
Some requirements genuinely do not apply. Say so, on the record.
Last updated September 22, 2026
Not every requirement in a framework applies to every organization. A control about industrial systems means nothing to a company that has none, and carrying it as a permanent gap makes your readiness view less useful.
Recording it
A requirement can be marked as not applicable with a reason. The reason is the point. "Not applicable" with no justification is indistinguishable from avoidance, and it is the first thing an assessor will ask about.
It stays visible
A requirement marked not applicable is excluded from your readiness figure but stays visible with its reason attached, so nothing disappears quietly. Anyone reviewing your readiness can see both what you excluded and why.
Review it periodically
Applicability changes. An acquisition, a new product or a new market can make a requirement relevant that genuinely was not before. Revisit these when your business changes rather than treating the first decision as permanent.