Applicability
Applicability is whether a law, regulation or standard reaches your organisation at all. In Sted it is worked out by rules from the answers you gave in onboarding, not by the AI model, and each recommended standard shows its outcome and the reasons behind it.
Where the term appears
Each law sets its own reach: where you are established, whom you sell to, what data you hold, how large you are. A standard such as ISO 27001 reaches you only when you choose it or a customer or regulator expects it. Sted’s outcomes reflect that range, from a plain “applies” through “applies in part” and “applies indirectly via a customer” to “pending more information” when a fact is missing. The classification and applicability page shows how to read them.
Applicable is not the same as adopted
Two different decisions share the word. Applicability asks which standards, regulations and schemes apply to you. A Statement of Applicability asks, inside a standard you have already chosen, which of its controls you apply and why you exclude the rest. Deciding not to adopt a law in any tool does not take you outside it; an auditor or regulator reads the law’s own scope test.
How Sted uses it
- Which standards apply to you, and a device’s class, are worked out by Sted’s rules from your recorded answers; the AI model does not decide them.
- Each recommended standard shows its basis (legal, contractual, customer, mixed or voluntary), its outcome where it is not a plain “applies” (applies in part, applies indirectly via a customer, pending more information), Sted’s confidence, and a “Why this is recommended” list.
- Administrators and Policy and Process Owners adopt or remove standards; everyone can see them.
- After onboarding you can reopen your answers from Organisation → Summary.
An outcome is information to help you decide, not legal advice. Where much turns on whether a law applies, confirm it with a qualified adviser.
Related terms
- Statement of Applicability (SoA): often confused with it; it decides controls, not standards.
- Control: what the SoA marks applicable or excluded.
- Personal data: processing it is the first applicability test for UK GDPR and EU GDPR.
- Audit readiness: a later question, how prepared you are for a standard you adopted.