What is the SoA, or Statement of Applicability?
The Statement of Applicability (SoA) in ISO 27001, the standard for Information Security Management Systems (ISMS), is the document that lists every information security control in the standard’s Annex A. In the current edition, ISO/IEC 27001:2022, there are 93 controls grouped into four themes: organizational, people, physical and technological. You can go through them one by one in our article on the ISO 27001 controls.
In the SoA the organization states whether each control applies, explains why, and gives its implementation status. This is required by clause 6.1.3 of the standard: the SoA must include the necessary controls, the justification for including them, whether or not they are implemented, and the justification for any that are excluded.
Although Annex A is the reference for implementing information protection measures, the organization can add controls from other sources if it needs them, and the SoA must include those too.
If your SoA still follows the 2013 edition (114 controls in 14 domains), it needs redoing: the transition period ended on 31 October 2025 and certificates against the old edition are no longer valid.
This is what part of an SoA might look like, using Annex A controls from ISO/IEC 27001:2022. Each row answers the four questions an audit checks: does the control apply, why, what state is it in, and where is the evidence.
At what point in implementing the Information Security Management System is the SoA produced?
Once the risk analysis and assessment are done, the organization has to choose treatment options for the risks and put in place the security measures to mitigate them. This is usually when the SoA is drawn up, to record which security controls apply.
Example: if the risk assessment shows the need for a control against malware (8.7 in Annex A), a treatment plan is defined covering the purchase, configuration and installation of antivirus software, implementation dates, resources and so on. Once it is in place, the Statement of Applicability must record why it was implemented and the necessary references to the procedures or technical controls put in place.
What the SoA contains
The SoA can be kept in whatever format suits the organization. What really matters is its content, which will usually include:
- the controls in the standard,
- whether they apply and why,
- their implementation status,
- related documentation (procedures, evidence, etc.),
- any other information worth recording.
Why the SoA matters
- The SoA gives traceability between the controls in the standard and what the organization actually does. It provides a broad view of how the organization protects its information and helps identify, organize and record the security measures in place.
- It justifies the inclusion or exclusion of each control, which the risk assessment report does not cover.
- Organizations that develop and implement an Information Security Management System (ISMS) and want ISO 27001 certification must have an SoA.
- Because it documents each applicable control and whether it has been implemented, it becomes the main guide for both internal and external auditors. The auditor will generally start from the Statement of Applicability, plan the audit around it and check that what is documented is actually done.
Review and updates
- The SoA is a living document. It must be reviewed and approved by the organization’s highest security authority, and updated whenever any of the following happens that means applying new security controls or reviewing existing ones:
- New information, whether generated internally, provided by third parties (customers, suppliers, etc.) or related to legal or regulatory compliance.
- Buying or replacing assets that hold or handle information (mobile devices, software, suppliers, new communication technologies, etc.), which may bring new threats and vulnerabilities.
- Organizational or operational changes that change how information is managed.
- Changes in the context or in the needs or requirements of interested parties: contracts or confidentiality clauses, new laws or regulations, expansion into new markets, new cybersecurity threats, etc.
You need to keep version control of your Statements of Applicability and record the changes made.
At GlobalSuite Solutions we offer the help and advice you need to implement your Information Security Management System (ISMS).
We also have GlobalSuite® software, developed entirely by our team, which supports the implementation, management and maintenance of every requirement in ISO 27001 for organizations of all kinds and sectors.
