Statement of Applicability (SoA)

The SoA is the output of a specific sequence in ISO/IEC 27001:2022 clause 6.1.3. The organisation selects risk treatment options (a), determines all controls necessary to implement them from whatever source it chooses (b), compares those controls with Annex A to verify that no necessary control has been omitted (c), and then produces the SoA (d), which must contain the necessary controls, the justification for including them, whether they are implemented or not, and the justification for excluding any Annex A control. The treatment plan (e) and the risk owners' approval of it and acceptance of residual risks (f) follow. The SoA is therefore not a checklist filled in from Annex A downwards but a reconciliation between the risk register and the catalogue.

Justifications for inclusion are usually one of three kinds: a treated risk (referenced by risk ID), a legal or regulatory requirement (for example NIS2 Article 21(2) or GDPR Article 32), or a contractual or business requirement. A good SoA keeps these traceable in both directions: from each risk to the controls that treat it, and from each control to the risks, laws or contracts that justify it. Controls from outside Annex A, such as specific CIS safeguards or sector requirements, belong in the SoA as well, because clause 6.1.3(d) speaks of the necessary controls, not only Annex A.

Exclusions are where auditors probe. "Not applicable" is acceptable only if no risk, legal requirement or contract calls for the control within the scope; excluding secure development (8.25-8.28) while the organisation writes code, or physical controls while it still has staff in an office, will be challenged. Implementation status should be honest: a control can be included but only partially implemented, with the gap tracked in the treatment plan. The 2022 transition forced every certified organisation to rebuild its SoA from 114 to 93 controls, typically using ISO/IEC 27002 Annex B to map old controls to new.

Practically, the SoA is a controlled, versioned document; certification bodies commonly reference its version on the certificate, so a material change in the SoA can affect what the certificate covers. Many organisations maintain it as a spreadsheet or in a GRC tool with columns for control, applicability, justification, status, owner, evidence location and linked risks, and use ISO/IEC 27002 attributes to produce filtered views. It is also the document customers most often request, sometimes under NDA, when assessing a certified supplier.