ISO 27001 Statement of Applicability: A Complete Guide (with Free Template)

The Statement of Applicability is the document auditors use to connect your information security risks, selected Annex A controls, implementation status, and supporting evidence. This guide explains what an ISO 27001 SoA must contain, how to build one against the 2022 control set, and includes a free template to help you get started.

What is the ISO 27001 Statement of Applicability (SoA)?

A Statement of Applicability (SoA) is a critical document in the ISO 27001 certification process that identifies specific controls from Annex A that the organization has chosen to implement to mitigate information security risks. Along with specifying which controls are within scope, the organization must also justify which controls it has excluded and why.

The SoA also captures how the controls are implemented, and points to the relevant documentation on the implementation of each control. It must also include the controls that aren’t relevant to your organization and, therefore, were omitted from implementation. SoA should also list the reason(s) for their exclusion.

ISO 27001 Standard in Clause 6.1.3 states that the SoA must:

• List of controls identified as a response to the identified risks
• Explain the choice of controls, how they have been implemented, and reasons for the omission of controls, where applicable

The SoA must be reviewed and approved by the management or relevant authority in the organization. And given the details of an organization’s security controls, the SOA should be treated as a confidential document.

Who needs to create an ISO 27001 Statement of Applicability?

An organization implementing an Information Security Management System (ISMS) must create the ISO 27001 Statement of Applicability (SoA) to achieve ISO 27001 certification or compliance. 

The team responsible for conducting the risk assessment and selecting controls from ISO 27001 Annex A develops the SoA, ensuring it reflects the organization’s specific security risks, operational needs, and compliance obligations. External consultants may assist, but the organization retains ownership of the document.

Importance of Statement of Applicability to ISO 27001

The Statement of Applicability is important since it lists out the controls that organizations implement to meet the ISO 27001 standard requirements. Here’s a look at some other reasons why SoA is important.

It is a ‘must-have’ document during internal audits

SoA is a central piece in your ISO 27001 jigsaw and, therefore, is a must-have document for auditors during internal audits, certification audits, and subsequent surveillance audits. Auditors build on their understanding of an organization’s security posture and its ISMS using it.

Makes for a quick and comprehensive overview of controls

The SoA gives a quick and comprehensive overview of the controls an organization has implemented and how, as well as details the reasons for excluding controls, wherever applicable. While an organization’s ISO 27001 risk assessment and risk treatment plan too would cover these, and do so in much detail, the SoA makes for an easier and shorter read of the implementation status of the technical controls.

Allows for traceability

The SoA shows the linkages between the controls of the ISO 27001 standard and its actual implementation in the organization. It also helps ensure no significant control is overlooked.

Acts as a useful reference guide

It makes for a nifty reference guide for stakeholders, including employees and customers, to understand how and why an organization treats its risks. It makes for a central document to refer to, understand and continually improve the ISMS.

Which version of the ISO 27001 Statement of Applicability is required?

Use ISO 27001:2022. It was published in October 2022 and replaced the 2013 version, and the transition period for existing certificates ended on 31 October 2025. Certificates issued against the 2013 version are no longer valid, so your SoA must be built against the 2022 Annex A.

What changed in the 2022 revision

The 2022 update reorganized and trimmed the controls but did not drop any:

• The 14 control categories became four themes: organizational, people, physical, and technological.
• The 114 controls were consolidated into 93, with no controls removed.
• 35 controls stayed the same, renumbered under the four themes.
• 11 new controls were added, including threat intelligence, information deletion, and data masking.
• 23 controls were renamed, and 57 were merged into 24.

What it means for your SoA

If your SoA still lists the 2013 structure (114 controls across 14 domains), it is out of date and will not pass an audit. Rebuild it against the 2022 Annex A: map your risks to the 93 controls, mark each as applicable or excluded with a justification, and record the implementation status. ISO 27002:2022 is the companion guide that explains each control if you need implementation details.

Which ISO 27001 controls under SoA do you need to include?

ISO 27001 lists its controls in Annex A. In the 2022 version, Annex A has 93 controls grouped into four themes: organizational, people, physical, and technological. You do not implement all 93. You implement the ones your risk assessment and risk treatment plan call for, and you record why you excluded the rest in your SoA.

So, you will need to scour over the ISO 27001 controls list and sift out those that don’t apply to your organization. And as was mentioned earlier, list reasonable explanations for the omission of those controls in the SoA. For instance, controls related to physical security at the workplace wouldn’t be relevant to a remote organization, but those related to teleworking would be.

The SoA can also include controls outside the purview of ISO 27001 but must be implemented in terms of legal, business or contractual requirements.

How to Create the ISO 27001 SoA

Completing the Statement of Applicability is a time-consuming process. It requires you to understand your organization’s business operations and interests thoroughly. It can be pretty daunting, so come prepared.

But don’t be put off by it. Once done well, this exercise would be reviewed/updated only once a year and might not require major overhauls.

Here’s a five-step process on how to develop a Statement of Applicability in ISO 27001.

1. Understand ISO 27001 requirements and the controls

To begin with, start with an understanding of the ISO 27001 requirements and ISO 27001 controls. Reading the controls list alongside ISO 27002 would help you understand the controls even better.

2. Conduct risk assessment

Start with the inventory of your information assets, and list the information security risks that could compromise the confidentiality, integrity, and availability of any of these assets within the scope of your Information Security Management Systems, ISMS. After identifying and defining your risk universe, assess the risks by their likelihood of occurrence and potential impact. You can rank each risk on a scale of 1-10 (10 being the highest impact) or rank them Low-Medium-High.

3. Complete the risk treatment plan

The Risk Treatment Plan documents an organization’s response to the many identified threats, vulnerabilities, and risks in the risk assessment process. The risk treatment plan will detail the security control implemented in response to the identified risk. Some of the security controls you can deploy to treat risks are ISO 27001 security awareness training, access control, penetration test, and vendor risk assessments, among others.

The ISO 27001 standard lines up four possible risk treatment options.

This document is critical, and is looked at in great detail by the external auditor during the ISO 27001 certification audit and the subsequent periodical audits.

4. Select the applicable ISO 27001 Controls

Based on the risk treatment plan and the specifics of the information security controls deployed, you can select the applicable controls.

You can evaluate the risks by breaking it down using the CIA triad (confidentiality, integrity, and availability). Doing so shows your commitment to a holistic SOA approach that does not just focus on just getting compliant, but actually prioritizing security.

5. Prepare the Statement of Applicability

Here are some valuable tips to consider before you embark on the task:

• As a best practice, begin with an understanding of the ISMS scope and keep the list of information assets, risk assessments and risk treatment plan handy. The SoA should be prepared as a coherent extension of what’s already been documented in these processes.
• Go through the controls listed in Annex A alongside ISO 27002, which complements your understanding of the controls by detailing the best practices for implementing ISO 27001 controls.
• Don’t take the task up in isolation. Involve HR, IT and other departments to help you through the process.

Sprinto is equipped with a toolkit to build an integrated pipeline of ISO 27001 controls and automated checks to ensure an ISMS. Manage your end to end compliance processes by effortlessly gathering evidence in an auditor-approved way towards ISO 27001 audit and certification without compromising speed or budget.

While many templatized versions of SoA are available, the easiest is to make your own on a spreadsheet. List all the controls on the spreadsheet, document if the control applies to your organization, the date of the last assessment, and if it’s not applicable, why. It’s a good practice to point to how the control is implemented through links to the details document for the relevant controls.

It’s critical to periodically review the applicability of the controls and continually improve it based on observations made during internal audits, and certification audits.

Traditionally, organizations, especially the smaller and inexperienced ones use semi-manual tools like Excel sheets, calculators, and documentation systems. Using these tools for planning, documenting, and implementing activities around risks, assets, and controls is easier said than done. More often than not, this spirals out of control and eats up engineering bandwidth.

Develop an ISO 27001 Statement of Applicability (SoA) with Sprinto

Good security practices require consistency throughout the year. They can’t yo-yo alongside your audit cycles. Sprinto brings an autonomous, AI-driven approach to compliance handling, evidence collection, continuous control monitoring, and risk detection in the background so your SoA stays accurate and audit-ready.

While it isn’t impossible to make your SoA, it does demand a lot of time and attention to it. But when you work with Sprinto, you can get an integrated risk assessment with pre-mapped controls. What’s more, you get hands-on support from our in-house compliance experts in preparing your SoA at no additional cost during your ISO 27001 certification.

Frequently asked questions