Term

Statement of Applicability

A document listing which ISO 27001 controls apply to an ISMS, and why.

The Statement of Applicability (SoA) is a required ISO 27001 artefact that documents which Annex A controls are in scope, which are excluded, and the justification for each decision.

Statement of Applicability, explained

If an ISO 27001 auditor could read only one document before arriving, it would probably be the Statement of Applicability. It is the bridge between your risk decisions and the Annex A control set, and it tells the auditor exactly what to expect to find in operation. A weak SoA tends to predict a difficult Stage 2 audit.

What the standard requires it to contain

Clause 6.1.3 d) of ISO/IEC 27001:2022 sets the minimum content. It is short, which is why organizations produce very different-looking SoAs that are all compliant.

The necessary controls, whether taken from Annex A or elsewhere
A justification for including each of those controls
Whether each necessary control is implemented or not
A justification for excluding any Annex A control

What real entries look like

Sample SoA rows for a cloud-hosted SaaS company

Sample SoA rows for a cloud-hosted SaaS company
Control	Applicable	Justification	Status	Reference
5.23 Information security for use of cloud services	Yes	Production runs entirely on a public cloud provider; risks R-003, R-011	Implemented	Cloud Security Standard v2
7.4 Physical security monitoring	No	No company-operated premises hold in-scope assets; offices host no servers or customer data, and the cloud provider's physical controls are assessed under 5.23	Not applicable	Supplier review 2026
8.28 Secure coding	Yes	In-house development of customer-facing application; risk R-019; customer contract requirement	Partially implemented, due Q4	SDLC Policy; treatment plan T-19
6.7 Remote working	Yes	Fully remote workforce; risk R-007	Implemented	Remote Working Policy

Notice that the justifications cite specific risks, contracts, or facts about the environment. The exclusion for 7.4 explains why the risk does not exist in scope, not simply that the control is unnecessary. And partially implemented controls are acknowledged with a plan rather than marked as done.

Building one, step by step

Complete the risk assessment and record results in a risk register.
Decide treatment for each risk and identify the controls required.
List all 93 Annex A controls and mark which of your chosen controls satisfy each.
Review the unmarked ones: either a risk was missed, or write an exclusion justification.
Add legal, regulatory, and contractual requirements that make controls mandatory regardless of risk score.
Record implementation status and link each control to its policy, procedure, or evidence.
Get it approved, version it, and review it whenever scope, risks, or controls change.

What auditors test

Consistency with the risk treatment plan: every control justified by a risk should trace back to it.
Exclusions that look convenient, such as excluding secure coding at a company that writes software.
Controls marked implemented that have no evidence, which quickly becomes a nonconformity.
A version and approval date that postdates the last significant change in scope.

FAQ

Frequently asked questions

Is the Statement of Applicability mandatory?

Yes. ISO/IEC 27001 clause 6.1.3 d) requires it, and it must be available as documented information. Certification is not possible without one. The auditor will use it to plan which controls to test and will compare it against your risk treatment plan and the controls observed in operation.

Can I exclude an Annex A control from my SoA?

You can exclude a control, but you cannot leave it off the document. Every Annex A control must be listed with a decision. Exclusions need a justification an auditor will accept, usually that the related risk does not exist within scope. Excluding a control because implementing it is inconvenient is not a valid reason.

How often should the SoA be updated?

Update it whenever the ISMS scope, risk assessment, or control set changes materially, and review it at least as part of the annual cycle of risk assessment and management review. Each version should be dated and approved so auditors can see which version was in force during the period they are examining.

What format should a Statement of Applicability be in?

ISO 27001 does not prescribe a format. Spreadsheets are common, as are exports from GRC platforms. What matters is that it contains the required elements, is controlled and versioned, and is consistent with the risk treatment plan. Many organizations add columns for control owner and evidence location to make audits smoother.

Keep exploring

Statement of Applicability

Related