ISO 27001 Statement of Applicability (SoA): what it is and how to write it
The Statement of Applicability (SoA) is the mandatory ISO/IEC 27001:2022 document that lists the 93 Annex A controls and, for each one, states whether it is necessary, why it is included or excluded, and whether it is implemented. Clause 6.1.3 d) requires it, and it links the outcome of your risk assessment to the controls your organization actually applies.
What does the standard require in the SoA?
Under clause 6.1.3 d), the organization must produce a Statement of Applicability that contains:
- The necessary controls, determined through risk treatment.
- The justification for including them.
- Whether those controls are implemented or not.
- The justification for excluding any Annex A control.
Necessary controls can come from Annex A or from other sources, such as customer or regulatory requirements. Annex A is used to check that no necessary control has been overlooked.
Recommended SoA columns
| Column | Content |
|---|---|
| Control | Annex A control number and name (5.1 to 8.34) |
| Theme | Organizational, people, physical or technological |
| Applicable? | Yes / No |
| Justification | Risk treated, legal, contractual or business requirement; or reason for exclusion |
| Implementation status | Implemented, partial, planned or not implemented |
| Reference | Policy, procedure or evidence supporting the control |
| Owner | Who maintains the control |
| Linked risks | Risk matrix IDs the control treats |
The 93 Annex A controls in 4 themes
| Theme | Range | Controls |
|---|---|---|
| Organizational | 5.1 – 5.37 | 37 |
| People | 6.1 – 6.8 | 8 |
| Physical | 7.1 – 7.14 | 14 |
| Technological | 8.1 – 8.34 | 34 |
How do you justify an exclusion?
An exclusion is valid when the control is not needed to treat any identified risk or to meet legal or contractual requirements. For example, a company with no in-house software development can exclude secure development controls by explaining that it does not develop software and that its suppliers are covered by the supplier relationship controls. The justification must be specific: writing only "not applicable" is a frequent nonconformity.
Steps to build the SoA
- Complete the risk assessment and decide how each risk will be treated.
- Determine the controls needed for that treatment.
- Compare against the 93 Annex A controls and mark the applicable ones.
- Write the justification for including or excluding each control.
- Record implementation status and evidence for each control.
- Have risk owners approve the treatment plan and accept residual risks.
- Review the SoA whenever risks, scope or controls change.
Common mistakes
- Marking every control as applicable with no link to risks.
- Excluding controls without a concrete justification.
- Declaring controls implemented without evidence.
- Using the 114-control list from the 2013 version in a 2022 SoA.
- Not updating the SoA after changes in scope or in the risk assessment.
Statement of Applicability template
The NexoDocs toolkit includes an Excel SoA with the 93 ISO/IEC 27001:2022 controls, drop-down lists for applicability and status, justification, evidence and owner columns, and an automatic summary by theme. It also includes a completed example for a fictional company. You can download the reduced risk matrix for free to try the format.
Frequently asked questions
Is the Statement of Applicability mandatory?
Yes. ISO/IEC 27001:2022 requires it in clause 6.1.3 d), and it is one of the first documents the auditor reviews during certification.
How many controls should the SoA include?
It must address all 93 Annex A controls of the 2022 version, stating for each whether it applies and why. It can also include additional controls from other sources.
Can Annex A controls be excluded?
Yes, when they are not needed to treat risks or to meet legal or contractual requirements. Each exclusion needs a concrete justification.
Who approves the Statement of Applicability?
Usually top management or the ISMS manager. The standard also requires risk owners to approve the risk treatment plan and accept residual risks.
Related guides
- ISO 27001:2022 mandatory documents: list by clause
- ISO 27001 risk assessment template: what it must include and how to use it
- What is an ISMS and how do you implement it with ISO 27001?
Updated: 2026-10-20