ISO 27001 Statement of Applicability (SoA)

What the Statement of Applicability does in an ISO 27001 system

The statement of applicability is the ISMS control register that turns risk treatment decisions into a readable governance record. It shows which Annex A controls are selected, which are excluded, and why those choices make sense for the organisation’s scope and risk profile.

That makes the SoA more than a compliance artifact. It is the bridge between risk assessment, control design, and audit evidence, so it must stay consistent with the organisation’s current risks, security objectives, and implementation status.

Why the SoA matters for control selection and exclusions

The SoA exists to make control choice defensible. If a control is included, the organisation should be able to explain how it supports treatment of identified risk. If a control is excluded, the reason should be explicit and credible, not just implied by a template or inherited from another business unit.

This is why the SoA is closely tied to governance discipline. It helps prevent “paper ISMS” behaviour, where controls are listed without a clear link to the threats, assets, legal obligations, or operating context that shaped the decision.

For practical reference, the ISO standard itself defines the management system baseline, while the control companion document provides the implementation detail behind control selection and wording in the SoA: ISO/IEC 27001:2022 Information Security Management and ISO/IEC 27002:2022 Information Security Controls.

How the SoA supports auditability and evidence

An effective SoA gives auditors and internal reviewers a single place to see the organisation’s control posture. It should make it clear not only what has been chosen, but also whether the chosen controls are implemented, partially implemented, or deferred under a documented treatment plan.

That visibility matters because gaps often appear when risk decisions, implementation work, and audit evidence drift apart. A current SoA reduces that drift by linking the chosen control set to the actual ISMS scope and to the evidence used in certification or surveillance activities.

When organisations need a practical readiness view, they often use a certification preparation lens that includes scope, risk treatment, SoA evidence, and management review: ISO 27001 Certification Readiness Checklist.

How the SoA fits into broader compliance and control mapping

The SoA becomes especially valuable when one control set must serve more than one assurance need. It can support crosswalks, evidence reuse, and consistent control language across standards, but only if the mapping is kept current and the underlying control intent is not distorted.

That is why many organisations treat the SoA as part of a wider control architecture, not just a certification document. It helps show which controls are common, which are duplicated, and where a single control can satisfy multiple governance requirements without weakening accountability.

Where organisations need to align iso 27001 with other control sets, a control mapping approach can help preserve that evidence chain: Control Mapping Guide and NIST CSF to ISO 27001 Mapping Guide.

Risk and Threat Considerations

An inaccurate or stale SoA creates real governance exposure because it can overstate control coverage, hide exclusions that no longer fit the risk picture, or leave implemented controls unsupported by evidence. That weakens both audit credibility and the organisation’s ability to prove that selected controls still match current threats and obligations.

Failure mechanism: The SoA drifts from the live risk assessment and implementation record, so the ISMS appears stronger on paper than it is in practice. Exclusions, partial implementations, and inherited control assumptions become difficult to challenge.

Impact: Certification findings, internal assurance failure, and missed remediation decisions become more likely, and the organisation may carry unmanaged risk because the control register no longer reflects the real security posture.

Practitioner Guidance

Why practitioners should care: Treat the SoA as a maintained governance record, not a one-time certification deliverable. Its value depends on whether control inclusion, exclusion, and implementation status stay aligned with scope changes, risk reassessment, and treatment progress.

Practitioner note: The strongest SoAs are concise but traceable, with each decision linked to a risk rationale that can survive both an auditor challenge and an internal security review.

Related resources from NHI Mgmt Group

• Guide: ISO 27001 Certification Guide
• How should security teams write an ISO 27001 Statement of Applicability so it stands up in audit and internal review?
• Why does the Statement of Applicability matter so much in an ISO 27001 programme?
• What do organisations get wrong when they complete an ISO 27001 Statement of Applicability?
• What happens if an ISO 27001 Statement of Applicability is not kept current after certification?