The Statement Of Applicability.

The Statement of Applicability (SoA) is a critical document in achieving ISO 27001 certification. It acts as a bridge between your organization's information security risk assessment and the control measures implemented within your Information Security Management System (ISMS).

Here's a breakdown of what the SoA entails:

• Lists Controls: It details all the information security controls outlined in Annex A of the ISO 27001 standard. Annex A provides a comprehensive list of recommended controls addressing various information security objectives.

• Applicability Assessment: For each control in Annex A, the SoA clarifies whether it's:

  • Implemented: The organization has chosen to implement this control to mitigate information security risks.
  • Excluded: The organization has decided not to implement this specific control. The SoA should justify this exclusion with a clear explanation. This might be because the control isn't relevant to the organization's context or there are alternative controls in place that achieve the same objective.

• Justification & Explanation: The SoA doesn't just list applicability; it also provides justification for the chosen approach. This explanation should demonstrate how the implemented controls address the identified information security risks effectively.

In essence, the SoA demonstrates to auditors during the ISO 27001 certification process that your organization has made informed decisions about information security controls. It showcases a tailored approach that balances the need for robust security with the specific context and risk profile of your organization.

If you need a copy of the Statement of Applicability you can request this via your Sales Contact or Customer Success Manager.