Glossary · ISO and management systems
The Statement of Applicability turns a risk assessment into controls you stand behind.
The ISO 27001 record that walks through Annex A control by control, noting whether each applies, why it was included or dropped, and whether it is in place.
Back to the glossary01 · In plain words
In plain words
The ISO 27001 record that walks through Annex A control by control, noting whether each applies, why it was included or dropped, and whether it is in place.
ISO/IEC 27001 asks you to compare the controls your risk treatment chose with the reference list in Annex A. The Statement of Applicability (SoA) records that comparison, control by control. It shows what you apply, what you leave out, and why.
Spelled out: Statement of Applicability (SoA), required by ISO/IEC 27001:2022.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
The SoA is the bridge between your risks and your evidence. A certification body's auditor uses it to plan which controls to sample, and a customer may ask to see it to understand what your certificate actually covers. Exclusions need reasons tied to your risk assessment or scope. An exclusion with no reason, or a control marked as implemented with nothing to show, is a common source of nonconformities.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Clause 6.1.3 of ISO/IEC 27001:2022
- Information security risk treatment, where the SoA is required.
- The Stage 1 audit
- The auditor reviews the SoA as part of your documented ISMS.
- A customer due-diligence request
- Some buyers ask for the SoA to see what the certificate covers.
- The certificate itself
- Certificates commonly reference the SoA version in force.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: an analytics agency that writes no code
A Chandigarh marketing-analytics agency builds dashboards in a third-party tool and writes no software of its own. In its SoA it marks the secure development controls as not applicable, citing the scope statement and a risk assessment showing no in-house development. The auditor accepts most of that but asks about scripts analysts write to clean data. The agency reclassifies one control as applicable and adds a simple review step for those scripts.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Risk treatment plan
- Says how each risk will be handled and by whom. The SoA lists the resulting controls against Annex A.
- SOC 2 control matrix
- Maps your controls to the Trust Services Criteria for an attestation. The SoA is an ISO 27001 requirement for certification.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Build the SoA after risk treatment, not before.
- Give every exclusion a reason linked to scope or risk.
- Point each implemented control to the evidence an auditor can sample.
- Version the SoA and update it when scope or risks change.
- GuideThe Statement of ApplicabilityHow to build the document auditors open first.
- GuideRisk assessment and treatmentA method that is repeatable, with the records an auditor reads.
Sources: ISO/IEC 27001:2022, clause 6.1.3 and Annex A (clause and control titles only); ISO/IEC 27002:2022, control titles.
Questions about Statement of Applicability
Can we exclude Annex A controls?
Yes, with a justification.
ISO/IEC 27001 allows a control to be excluded when you can explain why it is not needed. The reason should follow from your scope and risk assessment, and the auditor will test it.
Must we share the SoA with customers?
No, but many do on request.
The standard does not require you to publish it. Sharing it, often under a confidentiality agreement, helps a buyer see what your certificate covers.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.