Controls reported by system owner as not in place should not be tested but needs to be recorded as (passing, failing, of N/A) since report is basis for remediation plan. Response:

When a control is explicitly reported by the system owner as not being in place, it directly indicates that the control objective is not met. Recording it as 'Failing' accurately reflects its non-implementation and triggers the need for corrective actions within a remediation plan.

Recording a non-implemented control as 'Passing' would inaccurately suggest compliance and prevent its inclusion in a remediation plan.

'Scoping' refers to determining the applicability of controls to a system, not a status for non-implemented controls.

'Tailoring' involves modifying controls to fit specific organizational or system circumstances, not a status for non-implemented controls.