ISO 27001 Statement of Applicability (SoA): Guide and Template

Template Columns

Frequently Asked Questions

Is the SoA mandatory?

Yes. Clause 6.1.3 d) requires the organization to produce a Statement of Applicability.

What must the SoA contain?

The necessary controls (see 6.1.3 b and c); justification for inclusions; justification for exclusions of controls from Annex A; and whether the necessary controls are implemented.

Is Annex A a menu you can ignore?

Annex A is normative as a reference set. You compare necessary controls to Annex A so necessary controls are not inadvertently omitted; you may add controls from other sources.

Related ISO 27001 Resources

ISO 27001 hub · 93 controls · SoA · CSA · Risk assessment · Mandatory documents