Statement of Applicability: what it is

In short

The SoA is the summary of an information security management system: in a few pages it says which measures the company has chosen and which it has excluded, with the reasons. It is one of the first documents the certification auditor asks for, and often the customer who needs to qualify a supplier too.

What it contains

Clause 6.1.3 of ISO/IEC 27001:2022 requires the Statement to contain:

• the necessary controls to treat the risks identified;
• the justification for including them;
• whether the necessary controls are implemented or not;
• the justification for excluding any Annex A controls that do not apply.

In the 2022 version, Annex A has 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). The transition period from the 2013 version ended on 31 October 2025: valid certifications now refer to the 2022 version.

Why it matters

The SoA links the risk analysis to concrete measures: every control included should answer a risk, every exclusion should be defensible. "Not applicable" cannot mean "we did not think about it": a company with no in-house software development can exclude the secure development controls, but it cannot exclude vulnerability management. After treatment there remains the residual risk, which the risk owners must formally accept.

The document must be kept up to date: whenever the risks or the measures change, the SoA changes too, with a new revision. To prepare for certification, see the ISO 27001 checklist.

Example

A services company works entirely in the cloud, with no data centre of its own. In its SoA it declares the controls on cloud service security and supplier management applicable, justifying them with the risks linked to its providers. It declares the event logging controls applicable but only partly implemented, with an action under way. It excludes some physical controls on processing areas, because it has no technical premises of its own, and writes down why. The auditor starts from here to decide what to check.

A year later the company starts a small in-house development project to integrate its website with its management system. The SoA is updated: the secure development controls, previously excluded, become applicable, with the new justification and the implementation plan. A new revision of the document records the change.

Related terms

• Residual risk
• TLP
• NIS2
• Business continuity