The ISO 27001 Statement of Applicability, explained
The Statement of Applicability lists every Annex A control, records whether it applies to your ISMS, and justifies each inclusion and exclusion. It is a mandatory document and the one auditors examine most closely, because it shows whether your risk assessment actually drove your control selection.
What the SoA must contain
A compliant SoA is not a checklist. Each line needs four things.
- The Annex A control reference and title
- Whether the control is applicable (yes or no)
- Justification for that decision, tied back to your risk assessment or a legal or contractual requirement
- Current implementation status and, ideally, the owner
Justifying exclusions properly
Exclusions are legitimate. A company with no physical office can reasonably exclude some physical security controls. What auditors reject is an exclusion with no reasoning.
A good justification names the reason: no in-scope asset, risk accepted at a documented level, or requirement handled by a third party under contract. A bad justification says "not applicable" and stops.
How the SoA links to risk
The audit logic runs in one direction: risk assessment identifies risks, risk treatment selects controls, and the SoA records that selection. If your SoA includes controls that no risk points to, or excludes controls that a live risk requires, the chain breaks.
Auditors test this by picking a risk from your register and asking which control mitigates it, then checking the SoA agrees.
Common Stage 1 findings
What gets flagged
- Exclusions with no justification recorded
- A SoA that has not been updated after the risk assessment changed
- Controls marked implemented with no evidence or owner
- A SoA generated from a template that does not reflect the actual environment
- Version with no approval date or approver
Keeping it current
The SoA is a living document. It should be reviewed whenever the risk assessment is updated, whenever scope changes, and formally at management review. A SoA that has not changed in two years while the business has, is itself a finding.
Key takeaways
- The SoA is mandatory and covers every Annex A control.
- Every exclusion needs a recorded justification.
- The SoA must trace back to your risk assessment.
- Review it whenever risk or scope changes, not just before an audit.
Frequently asked questions
How many controls are in Annex A?
ISO 27001:2022 Annex A contains 93 controls grouped into four themes: organisational, people, physical and technological.
Can we exclude a whole theme?
Rarely, and it would need strong justification. Excluding all physical controls, for example, needs a clear explanation of how physical risk is handled by others.
Who should approve the SoA?
Someone with authority over the ISMS, typically the ISMS owner or a member of senior management. The approval should be dated.
Does the SoA need to be shared with customers?
No. It is an internal ISMS document. Customers receive the certificate, not the SoA.
Get audit-ready in 8 to 12 weeks
Certifyi pairs the platform with a named compliance lead, with transparent, scope-based pricing.
Book a readiness call Start the free self-assessment