The Statement of Applicability in Sted
Sted keeps a Statement of Applicability (SoA) for each adopted standard with a control catalogue, such as ISO 27001. Each SoA is a card on Summary listing every control by theme as Applicable, Excluded or Not addressed. You exclude a control with a coded reason and a justification, and an administrator can export the complete SoA as a PDF.
What this is
ISO 27001:2022 6.1.3 d) asks for a Statement of Applicability: the controls you need, whether each is implemented, why you include it, and why you exclude any Annex A control you leave out. The Statement of Applicability glossary entry explains the term, and how to write a Statement of Applicability covers doing it well.
In Sted you do not write the SoA as a separate document. Each card is built from your adopted documents: a control reads Applicable when a requirement linked to it is adopted, Excluded when every linked requirement is excluded, and Not addressed otherwise. Other standards with a control catalogue get a card too; a standard without one gets none.
Where to find it
Open your organisation’s name in the sidebar, then Summary, and scroll to the Statement of Applicability card for the standard, titled with its edition, such as ISO 27001:2022. On a phone, select Menu at the top of the screen first.
How it works
Read the card
The card opens with a count line, such as the number of controls, how many are applicable, excluded and not addressed. Controls are grouped by theme, and each row shows the control, its title, its status, any exclusion reason, its implementation status and when it was last verified.
Decide a control
- Select Decide on the control’s row.
- Choose a reason in Exclusion, or Not excluded to clear an exclusion.
- Write a Justification.
- Choose an Implementation status.
- Select Save.
The nine exclusion reasons are five kinds of not applicable (no physical premises, fully cloud hosted, no software development, no remote working, no relevant assets), Addressed by a provider, Risk accepted, Covered by another control and Other (see the justification). Other needs a justification; for the rest it is optional, though an auditor will expect one. The implementation statuses run from Not started through In progress, Implemented and Operating effectively to Under remediation.
An excluded control counts as decided for audit readiness, just as an adopted requirement does.
When a document has a draft in progress
While a newer draft of a document is being prepared, its controls cannot be decided; approve the draft first. An exclusion you set on the Approved version does not carry into a draft that already exists. Approving documents and versions covers the approval, which itself waits for any updated recommendations.
Export it
An administrator selects Export as PDF on the card. The PDF prints the complete SoA, grouped by theme, with the same counts, words and columns as the card.
Permissions
| Action | Administrator | Policy and Process Owner | Reviewer | Personnel |
|---|---|---|---|---|
| See the SoA cards | Yes, complete | Yes, partial view | Yes, partial view | Yes, partial view |
| Decide a control from the card | Yes | No | No | No |
| Export the SoA as a PDF | Yes, on a paid plan | No | No | No |
Below administrator the card carries a note that it is a partial view: you see the requirements in the documents open to you, so some controls may read Not addressed that an administrator sees decided. Decide and Export as PDF appear for administrators only.
Limits and plan features
Only standards with a control catalogue get a card. The SoA PDF is an administrator’s alone, because only their view is complete. Like other exports it needs a paid plan; on Preview the button opens an upgrade prompt.
Related guides
- How to write a Statement of Applicability: what to include and how auditors read it.
- ISO 27001: the standard that requires an SoA and the controls behind it.
- Annex A: the control set most SoA rows come from.
- Audit readiness: how decided controls feed your readiness score.
Frequently asked questions
Does Sted produce a Statement of Applicability for ISO 27001?
Yes. Once you adopt ISO 27001, the Summary carries a Statement of Applicability card listing its controls by theme, each Applicable, Excluded or Not addressed, with the reason for any exclusion. An administrator can export it as a PDF on a paid plan.
Why does my SoA say Not addressed for a control we cover?
Either no requirement in your documents is linked to that control, or the linked requirements were left unticked. Below administrator there’s a third reason: you only see the requirements in documents open to you, so the card is a partial view.
Can a Policy and Process Owner export the SoA?
No. Only an administrator sees the complete SoA, because what anyone else sees is limited to the documents open to them, so only administrators can export it as a PDF.
What reasons can I give for excluding a control?
There are nine: five not-applicable reasons (no physical premises, fully cloud hosted, no software development, no remote working, no relevant assets), addressed by a provider, risk accepted, covered by another control, and Other, which needs a written justification.