What is a Statement of Applicability?
A Statement of Applicability (SoA) is the ISO 27001 document that lists every Annex A control, says whether it applies to your organisation, explains why, and records whether it is implemented. Certification auditors use it as the map of your information security management system.
What it contains
For each Annex A control, the SoA states four things: whether the control is included, the justification for including it, the justification for any exclusion, and whether it is implemented. The justification normally points back to the risk assessment, a legal or contractual requirement, or a business decision.
The SoA also lists any controls you add beyond Annex A. ISO 27001 lets you use other control sets, but you still have to compare your controls against Annex A so nothing necessary is missed.
Why auditors start with it
The SoA connects the risk assessment to the controls you actually run. In the Stage 1 audit the certification body checks that it is complete and consistent with the risk treatment plan. In Stage 2 and in every surveillance audit, auditors use it to choose which controls to test and which evidence to sample.
An exclusion without a credible reason is one of the most common findings. Excluding physical security controls because the team works remotely, for example, still needs to explain how laptops and home working are protected.
- Complete. Every Annex A control appears, including the ones you exclude.
- Justified. Each inclusion and exclusion has a reason a third party can follow.
- Current. The status matches what is really in place, and the document is version controlled.
- Consistent. It agrees with the risk treatment plan and the scope statement.
Keeping it current
The SoA is not written once for the audit. It changes when the scope changes, when a new risk leads to a new control, or when a control is retired. Review it at least at each management review, and record who approved each version. In Certifyi you set your Statement of Applicability per control, so each decision is recorded on the control it concerns.
Organisations certified against ISO 27001:2013 had until 31 October 2025 to move to the 2022 edition, whose Annex A has 93 controls in four themes instead of 114 in fourteen domains. The SoA is where that change shows most clearly.
Questions
Statement of Applicability (SoA), answered
Is the Statement of Applicability mandatory?
Yes. ISO 27001 clause 6.1.3 d) requires it, and a certification body will not certify an ISMS without one.
Can we exclude Annex A controls?
Yes, if the exclusion is justified. The usual reasons are that the risk does not exist in your scope, or that another control already treats it. The justification has to be written down in the SoA.
How often should the SoA be updated?
Whenever the scope, risks or controls change, and at least at each management review. Keep earlier versions so an auditor can see what changed and when.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them