Statement of Applicability (SoA)
A Statement of Applicability (SoA) is the ISO 27001 document that lists every Annex A control, says whether you apply it, gives your reason either way, and records whether it is implemented. Clause 6.1.3 d) requires it, and it is usually the first document a certification auditor asks for.
- Short form
- SoA
- Clauses
- ISO 27001:2022 6.1.3 d) · ISO 27001:2022 Annex A 8.25 · ISO 42001:2023 6.1.3
Where the term appears
ISO 27001:2022 6.1.3 d) sets out what the SoA must contain: the controls you need, why each is included, whether each is implemented, and why any Annex A control is excluded. The 2022 edition’s Annex A has 93 controls in four themes, numbered 5 to 8, and your SoA may add controls from other sources. ISO 42001:2023 6.1.3 asks for a Statement of Applicability against its own Annex A for AI management systems.
An exclusion needs a reason tied to your risk assessment or your scope. “We do not develop software” can justify excluding secure development controls such as 8.25; “not a priority for us” cannot. The implementation column has to be true on the day of the audit: a control marked implemented with no evidence behind it is a finding. Certificates usually reference the SoA version they were issued against, so tell your certification body when it changes.
How Sted uses it
- Sted keeps a Statement of Applicability for each adopted standard with a control catalogue.
- Only standards with a control catalogue get a Statement of Applicability card.
- You can exclude a control with a coded reason and justification and record its implementation status.
- Only administrators can export the SoA as a PDF, because only their view is complete.
Related terms
- Annex A: the control set the SoA is measured against.
- Risk treatment plan: the companion document. The SoA says which controls; the plan says how and by when.
- Control: one line of the SoA.
- ISMS: the management system the SoA belongs to.
- How to write a Statement of Applicability: the task, step by step.