# Statement of Applicability (SoA)

The ISO 27001 document that lists every Annex A control, whether you apply it, why, and whether it is implemented.

Source: https://sted.digital/docs/glossary/statement-of-applicability · Last reviewed 17 October 2026 · Strand Glossary

A Statement of Applicability (SoA) is the ISO 27001 document that lists every Annex A control, says whether you apply it, gives your reason either way, and records whether it is implemented. Clause 6.1.3 d) requires it, and it is usually the first document a certification auditor asks for.

## Where the term appears

ISO 27001:2022 6.1.3 d) sets out what the SoA must contain: the controls you need, why each is included, whether each is implemented, and why any Annex A control is excluded. The 2022 edition's Annex A has 93 controls in four themes, numbered 5 to 8, and your SoA may add controls from other sources. ISO 42001:2023 6.1.3 asks for a Statement of Applicability against its own Annex A for AI management systems.

An exclusion needs a reason tied to your [risk assessment](/docs/guides/risk-assessment) or your scope. "We do not develop software" can justify excluding secure development controls such as 8.25; "not a priority for us" cannot. The implementation column has to be true on the day of the audit: a control marked implemented with no evidence behind it is a finding. Certificates usually reference the SoA version they were issued against, so tell your certification body when it changes.

## How Sted uses it

Sted keeps a Statement of Applicability for each adopted standard with a control catalogue.
Only standards with a control catalogue get a Statement of Applicability card.
You can exclude a control with a coded reason and justification and record its implementation status.
Only administrators can export the SoA as a PDF, because only their view is complete.

## Related terms

- [Annex A](/docs/glossary/annex-a): the control set the SoA is measured against.
- [Risk treatment plan](/docs/glossary/risk-treatment-plan): the companion document. The SoA says which controls; the plan says how and by when.
- [Control](/docs/glossary/control): one line of the SoA.
- [ISMS](/docs/glossary/isms): the management system the SoA belongs to.
- [How to write a Statement of Applicability](/docs/guides/statement-of-applicability): the task, step by step.