Statement of Applicability (SoA)
The Statement of Applicability (SoA) is the ISO 27001 document listing every Annex A control with a decision — applicable or excluded — and a justification for each. It’s the contract between your risk assessment and your audit: certification auditors work through it line by line.
The ISO 27001 document that lists every Annex A control with a decision — applicable or excluded — and a justification, connecting the risk assessment to the controls an auditor will verify.
The SoA isn’t written first; it falls out of risk treatment.
Glossary · Statement of ApplicabilityWhere the SoA comes from
The SoA isn’t written first; it falls out of risk treatment. You assess risks, decide how to treat them, and the treatments map to controls from Annex A, plus any you add from other sources. Each control then gets one of two verdicts: applicable, with a note on how it’s implemented, or excluded, with a justification an auditor will probe. A fully remote company might legitimately narrow some physical-security controls — but “we didn’t get around to it” is not a justification.
The audit’s table of contents
Certification auditors treat the SoA as the index of your ISMS: during stage 2 they walk it line by line, asking for evidence that each applicable control operates the way the document claims. That makes it the single highest-leverage artifact in an ISO 27001 program — every overstated row is a finding waiting to happen, and every version-control lapse invites scope confusion during fieldwork.
Keeping it honest
The classic failure mode is a template SoA describing a company that doesn’t exist — controls marked applicable because the template shipped that way. The fix is boring and effective: revisit the document whenever risk changes, when new systems enter scope, and before each audit, and make one named person accountable for keeping it synchronized with what actually runs.
Glossary
A Statement of Applicability that matches reality
Agency’s compliance engineers derive the SoA from your actual risk assessment and keep it synchronized with what runs in production between audits. 500+ programs delivered. Rated 4.9 out of 5 stars on G2.
Platform Products
Agency AIEnd-to-end cybersecurity and compliance, across the stack you already use.GRC IntegrationsEngineer-operated GRC platform integrationAuditsuisse AIAI-powered evidence collection and analysis for IT audits.Find your auditor
Auditnex makes buying audits simpler and more transparent.
Agency implements the controls, collects the evidence, and manages your auditor relationship on top of the GRC tools you already use.
Explore AuditnexCommon GRC Questions
GRC Platform & Virtual CISO FAQ
The long-form FAQ on how managed GRC and virtual CISO coverage work together.
Read the FAQMore from Agency
See it on the home pageBuild a Security & Compliance Team Led by Your Own Virtual CISO
Forward-Deployed Engineers + AI that lower costs, increase velocity, and raise the bar — from policy to audit to remediation. U.S.-based forward-deployed engineers, supercharged by proprietary AI, operate your program end-to-end — on top of the tools you already trust.