ISO 27001 Statement of Applicability Explained + Template

In this guide, you will learn what an ISO 27001 Statement of Applicability is, how to write it yourself and I give you a template you can download and use right away.

ISO 27001 Statement of Applicability Explained

The ISO 27001 Statement of Applicability documents the information security controls that apply to your business and is a key document in the information security management system (ISMS). It is one of the first documents and auditor will normally ask for. As a minimum it lists all of the ISO 27001 Annex A controls and records if they apply to your business or not. If not, it will record why not.

A Statement of Applicability, or SoA, is basically a checklist for your company’s information security. When you want to get ISO 27001 certified, you have to show that you’re protecting your data. The SoA is where you list all the security controls you’ve chosen to use. You’ll also explain why you picked those and why you left others out. It’s your way of saying, “Here’s what we do to stay secure, and here’s why.”

ISO 27001 Statement of Applicability: Implementation & Technical Governance Overview

Compliance Aspect	Strategic Description & Purpose	Technical Application & Scope
Why You Need It	Vital for the ISO 27001 certification process; it documents security decisions, demonstrates technical compliance to auditors, and formalises risk management strategies.	Clause 6.1.3 Compliance & Audit Evidence
When You Need It	Created immediately following the risk assessment. It serves as the final technical bridge between identified risks and the selection of Annex A security controls.	Post-Risk Assessment Phase
Who Needs It	Any organisation seeking ISO 27001 certification, ranging from SMEs and tech startups to global corporations, to prove their commitment to information security.	Mandatory for all ISMS Scopes
Where You Need It	Maintained as a ‘living’ internal document within the ISMS. It is the primary reference point during external Stage 1 and Stage 2 certification audits.	Internal Governance Framework
How to Write It	Inventory all 93 controls from ISO 27001:2022, determine applicability, provide technical rationales for implementations or exclusions, and obtain senior management sign-off.	Annex A Control Scoping & Justification

Template

The ISO 27001:2022 Statement of Applicability Template used in this guide is available to download. This is an ISO 27001 statement of applicability excel worksheet that is fully populated with all of the required controls and fully meets the requirements for ISO 27001 certification.

How to write it yourself

Implementing your SoA means putting your plans into action. If your SoA says you’ll use two-factor authentication, you need to make sure you’ve actually set it up. It’s all about making sure what you wrote on paper is what you’re doing in real life. This is the part where you make your security promises a reality.

To implement an ISO 27001 Statement of Applicability (SoA), you must inventory all 93 Annex A controls and document technical rationales for their inclusion or exclusion. This formal record satisfies Clause 6.1.3 requirements, providing auditors with a traceable map of your chosen security posture for 2026 certification.

Step 1: Acquire the ISO 27002:2022 Implementation Guidance

Purchase the formal ISO 27002:2022 standard. While Annex A of ISO 27001 lists the controls, ISO 27002 provides the mandatory technical implementation guidance required for auditor-ready justifications.

• Action: Provision a legal copy of the ISO 27002:2022 standard.
• Result: Access to the technical depth required to implement each of the 93 controls.

Step 2: Provision the Microsoft Excel SoA Framework

Construct a centralised tracking spreadsheet to manage the ISMS scope. This framework must facilitate version control and granular tracking of the 2022 control set.

• Action: Create columns for Control ID, Title, Objective, Applicability, Justification, and Last Assessment Date.
• Result: A functional technical ledger ready for data population.

Step 3: Map Annex A Controls into the Ledger

Transfer the control numbers, titles, and technical objectives directly from the standard into your spreadsheet. This prevents the omission of “New” 2022 controls like Threat Intelligence or Data Masking.

• Action: Laboriously index each of the 93 controls as individual rows.
• Result: A comprehensive baseline that ensures 100% standard coverage.

Step 4: Formalise Technical Rationales for Inclusion

Document the specific drivers for every applicable control. Auditors reject “Because the standard says so”; you must attribute implementation to technical or business necessity.

• Action: Assign each control to a Contract, Legal, Risk, or Business rationale.
• Result: A defensible audit trail that justifies your security investment.

Step 5: Document Auditor-Ready Exclusion Justifications

Explicitly state why any non-applicable controls do not present a risk to your environment. If you do not write code or have a physical office, you must record this rationale to satisfy Clause 6.1.3(d).

• Action: Record specific justifications for “Out-of-Scope” areas like Secure Development or Physical Perimeters.
• Result: Elimination of Major Non-Conformities during the Stage 2 audit.

Step 6: Establish a Mandatory Annual Review Cycle

Review control applicability whenever significant changes occur and at minimum every 12 months. This proves to the auditor that the SoA is a “Living Document” and not a static artifact.

• Action: Timestamp the last assessment date for every control row.
• Result: Continuous compliance posture that reflects the current threat landscape.

Step 7: Tying Reviews to Management Meeting Minutes

Formalise the SoA sign-off within your Management Review Meetings. Tying the document status to your governance minutes is a Tier-1 audit requirement for 2026.

• Action: Record the SoA approval in formal meeting minutes.
• Result: Documented proof of Senior Management commitment to the ISMS.

ISO 27001:2013 vs 2022 SoA Comparison Table

Feature	ISO 27001:2013 (Old)	ISO 27001:2022 (New)
Total Controls	114 Controls	93 Controls
Structure	14 Control Domains (A.5 to A.18)	4 Themes (Organisational, People, Physical, Tech)
New Controls	None	11 New Controls (e.g., Threat Intelligence, Cloud Services)
Control Attributes	Static descriptions	Includes #Tags (e.g., #Prevention, #Detection, #Cyber)
Transition Focus	Legacy focus on physical perimeter	Modern focus on Cloud, Privacy, and Data Deletion

The 11 New ISO 27001:2022 Controls

ID	Control Name	Requirement Description	Required Audit Evidence
5.7	Threat Intelligence	Collect and analyse threat data to provide situational awareness.	Vetted source list (NCSC/feeds), sample reports, and firewall/EDR action logs based on alerts.
5.23	Cloud Services Security	Protect data throughout the cloud lifecycle (acquisition to exit).	Cloud Security Policy, Shared Responsibility Matrix, and provider ISO 27001/SOC2 cert reviews.
5.30	ICT Readiness	Ensure ICT systems are recoverable within required timeframes (RTO/RPO).	BCP/DR plans with specific targets and documented failover/recovery test results.
7.4	Physical Monitoring	Detect unauthorised physical access using continuous monitoring.	CCTV maintenance logs, server room access logs, and sensor trigger response records.
8.9	Configuration Management	Manage security configurations for hardware, software, and networks.	Hardened baselines (CIS), change management logs, and drift detection reports.
8.10	Information Deletion	Delete data when no longer required for compliance or business.	Data Retention Schedule, software-generated deletion logs, and physical destruction certs.
8.11	Data Masking	Protect sensitive data using pseudonymisation or anonymisation.	Data Masking Policy, technical implementation records, and access logs for unmasked data.
8.12	Data Leakage Prevention	Detect and prevent unauthorised disclosure of sensitive info.	DLP tool configuration, logs of blocked transfers, and exfiltration incident reports.
8.16	Monitoring Activities	Monitor systems and applications for anomalous behaviour.	SIEM/Log alerts, activity baselines vs. anomalies, and periodic security log review evidence.
8.23	Web Filtering	Manage access to external websites to reduce malware exposure.	Web filtering policy, blocked malicious category logs, and URL white-list approval records.
8.28	Secure Coding	Apply secure coding principles to all software development.	Secure Coding Standards (OWASP), peer review logs, and SAST/DAST vulnerability reports.

ISO 27001 Annex A Control Owner Matrix

Department / Role	Primary Annex A Themes	Typical Evidence Required
Human Resources (HR)	Theme 6 (People Controls)	Screening records, signed NDAs, training logs, and termination checklists.
IT / DevOps	Theme 8 (Technological Controls)	System logs, encryption configs, backup reports, and secure coding SAST results.
Facilities / Office Mgmt	Theme 7 (Physical Controls)	CCTV logs, maintenance records for fire/power, and physical access visitor logs.
Legal & Compliance	Theme 5 (Organisational Controls)	Legal registers, supplier contracts, privacy impact assessments (DPIA), and IP registers.
C-Suite / Leadership	Theme 5 (Governance)	Management Review Meeting (MRM) minutes and signed SoA approval documents.

Applicability to Small Businesses, Tech Startups, and AI Companies

Whether you’re a small business, a new tech startup, or an AI company, the SoA is a must-have. Here’s a quick look at why it’s so important for each:

ISO 27001 Statement of Applicability: Sector-Specific Requirements & Implementation Examples

Organisation Type	Strategic Business Case	Practical Technical Examples
Small Businesses	Vital for establishing commercial trust with enterprise-level clients by demonstrating technical security maturity.	Mandating encryption for payment processing while excluding redundant physical controls like on-site security guards.
Tech Startups	Enables scalable innovation by embedding risk management and data protection into the product development lifecycle.	Priority focus on secure coding practices (Annex A 8.28) and granular access control for production environments.
AI Companies	Critical for safeguarding proprietary AI models and ensuring ethical handling of massive training datasets.	Implementation of data anonymisation techniques and technical protections for Intellectual Property (IP) theft prevention.

How the ISO 27001 Toolkit Can Help

An ISO 27001 toolkit is a lifesaver. It’s a package of pre-made documents, templates, and guides. It helps you quickly put together your SoA, saving you a ton of time and effort. It takes the guesswork out of the process, making it much easier to achieve certification.

Key Feature	HighTable ISO 27001 Toolkit	Online SaaS Platforms
Data Ownership	Permanent: You maintain absolute ownership of your files. Downloaded documents remain on your secure infrastructure indefinitely.	Rental Model: Access to your compliance data is revoked immediately upon termination of the monthly subscription.
Ease of Use	Zero Training: Fully compatible with Microsoft Word and Excel; your team is already proficient in the required software.	Learning Curve: Requires extensive, non-billable training on proprietary user interfaces and platform-specific logic.
Cost Structure	One-off Fee: Transparent pricing with no hidden renewals, per-user charges, or mandatory annual subscriptions.	Recurring Expense: Opaque, high-cost recurring fees that create a long-term drain on the information security budget.
Vendor Lock-in	Total Freedom: Portability is guaranteed. You can migrate your data between internal systems without “walled garden” restrictions.	Locked-in: Significant technical hurdles when attempting to export data in human-readable formats if you choose to switch.
Audit Readiness	Immediate: Highly portable files that can be instantly shared with auditors via secure email or shared drives.	Dependent: Often requires granting external platform access to auditors or navigating complex export menus.

Information Security Standards That Need It

The Statement of Applicability is a core part of the ISO 27001 standard. You won’t find it in other standards, but many of them, like SOC 2 or NIST, have similar requirements for documenting security controls. The SoA is unique to ISO 27001, making it a key part of that specific certification. Other standards that may benefit include:

Security Standard / Framework	Relationship to ISO 27001 SoA	Primary Regulatory Focus
ISO 27001	Mandatory Requirement: The core technical record of control selection and justification per Clause 6.1.3.	Global Information Security Management
SOC 2	The SoA maps directly to the SOC 2 Trust Services Criteria (TSC) for control documentation and validation.	Service Organisation Controls & Trust
NIST	Utilised to align ISO 27001 Annex A controls with the NIST Cybersecurity Framework (CSF) subcategories.	Critical Infrastructure & Federal Security
NIS2	Supports the mandatory risk management measures and reporting obligations required by the EU Directive.	Network and Information Security (EU)
DORA	Provides the baseline for digital operational resilience and ICT risk management frameworks in financial services.	Financial Sector Digital Resilience
GDPR / CCPA	Acts as evidence for technical and organisational measures (TOMs) required for data privacy protection.	Global Data Privacy & Protection
HIPAA	Enables mapping of Administrative, Physical, and Technical Safeguards for protected health information.	Healthcare Information Portability

List of Relevant ISO 27001:2022 Controls

The ISO 27001 Statement Of Applicability is defined in ISO 27001 clause 6.1.3 Information Security Risk Treatment

ISO 27001 SoA Cross-Standard Mapping Table

ISO 27001:2022 Theme	SOC 2 Trust Services Criteria (TSC)	NIST CSF 2.0 Mapping
Organisational (Theme 5)	CC1.0 Control Environment & CC5.0 Control Activities	GV.OC (Organisational Context) & GV.PO (Policy)
People (Theme 6)	CC2.0 Communication and Information	PR.AT (Awareness and Training)
Physical (Theme 7)	CC6.4 Physical Access Controls	PR.PS (Physical Security)
Technological (Theme 8)	CC6.0 Logical & Physical Access / CC7.0 System Operations	PR.AC (Access Control) & PR.DS (Data Security)
Monitoring & Review	CC4.0 Monitoring Activities	ID.IM (Improvement) & DE.AE (Analysis)

Advanced Guidance

How do you decide what controls to include in a Statement of Applicability (SoA)?

You decide on the controls to include in the Statement of Applicability (SoA) in a number of different ways.

The main approach to identifying the controls that you need is:

• Define ISMS Scope: Establish the organisational boundaries and applicability of your Information Security Management System to provide a clear foundation for control selection.
• Conduct Risk Assessment: Perform a formal evaluation to identify and analyse specific information security risks that threaten your business assets and operations.
• Select Annex A Controls: Identify and choose relevant security controls from ISO 27001 Annex A that effectively mitigate the risks discovered during your assessment.

As a minimum that list of controls is going to include the ISO 27001 Annex A controls. That forms the bare minimum part of the ISO 27001 certification. And to be fair is often enough.

Of course, there may be additional controls that you’re going to record as well that you are implementing either from other standards or from direct requests from your customers.

Additional customer requirements would be captured on your legal and contractual register and the actual controls would be added to your Statement of Applicability (SoA).

As a basic requirement we are going to make a start and we are going to include the ISO 27001 Annex A controls and list them. 

The list of ISO 27001 Annex A controls is going to be used many times. 

What if the Statement of Applicability (SoA) controls don’t apply?

It is very possible that the list of controls provided in the ISO 27001 Annex A controls includes controls that do not apply to your organisation.

So what should you do? Implement them anyway to pass the ISO 27001 certification?

No.

The approach that you take is record in the Statement of Applicability (SoA) that the controls do apply to you and you state the reason that they do not apply.

If you do not have physical premises and remote work then it is highly possible that the Physical Security Controls such ISO 27001 Annex A Control 7.1 Physical security perimeter, ISO 27001 Annex A Control 7.2 Physical entry controls that apply to data processing facilities will not apply to you. If you do not do software development then the software development controls such as ISO 27001 Annex A 8.25 Secure Development Life Cycle do not apply to you.

Have a complete list but show and record the controls that are not applicable stating the reason why.

As a top tip it would be my recommendation to record all of the out of scope controls on the risk register and manage them through the risk management process which includes accepting the risk and documenting the decision as evidence.

ISO 27001 Statement of Applicability (SoA) vs Risk Treatment Plan (RTP) Technical Comparison

Feature	Statement of Applicability (SoA)	Risk Treatment Plan (RTP)
Primary Goal	A comprehensive “Inventory of Controls” that justifies every implementation or exclusion decision.	An “Action Plan” detailing how specific risks will be mitigated, accepted, or transferred.
Clause Reference	Mandatory under Clause 6.1.3(d).	Mandatory under Clause 6.1.3(e).
Focus Area	Broad: Covers all 93 controls from Annex A.	Narrow: Focused only on controls needed to address specific risks found in the assessment.
Auditor View	Used to verify the Scope of the ISMS.	Used to verify the Operation and progress of security improvements.
External Sharing	High: Often shared with customers to prove security posture.	Low: Usually kept internal as it contains sensitive details about vulnerabilities.

ISO 27001 SoA Redaction and Sharing Policy

ISO 27001 SoA Version Control Template

ISO 27001:2022 Control Attributes and #Tags Matrix

FAQ

About the author