Statement of Applicability (SoA)
The Statement of Applicability (SoA) is the mandatory ISO/IEC 27001 document that lists all 93 Annex A controls and records, for each one, whether it is included in your ISMS, why, and its implementation status.
What goes in it
Clause 6.1.3(d) requires the SoA to contain the necessary controls (from your risk assessment and any other sources), the justification for each inclusion, whether each control is implemented or planned, and the justification for every exclusion. Auditors treat it as the index of your entire ISMS — it is usually the first document they ask for.
Exclusions need more care than inclusions. You can only drop an Annex A control if you can justify it — typically because the risk it treats does not exist in your scope (for example, physical access controls for a fully remote company with a cloud-only estate).
Keeping it alive
The SoA is versioned and reviewed — after risk assessments, audits, incidents, and organizational changes. Treat it as a living register with owners and status, not a certification artifact you write once and file away.
Related Standards
- •ISO/IEC 27001:2022 — Clause 6.1.3(d)
- •ISO/IEC 27002:2022 — Annex A control guidance
Free Tools & Resources
Further Reading
Need help with this?
We consult and build across all of these domains — tell us what you are working on.