ISO 27001 Statement of Applicability template

The Statement of Applicability (SoA) is the single most-scrutinised document in any ISO 27001 audit. It is a clause-6.1.3(d) deliverable that lists every Annex A control, states whether you implement it, the justification for inclusion or exclusion, and the implementation status. Auditors will spend roughly 40% of stage-1 audit time on the SoA alone.

• Required by clause 6.1.3(d) of ISO/IEC 27001:2022
• Lists all 93 Annex A controls (down from 114 in the 2013 version)
• Must state include/exclude decision for each
• Justifications must be specific — "not applicable" alone fails audit

The 2022 revision restructured controls into four themes. The total count dropped from 114 to 93 because of consolidation, plus 11 new controls were added.

• Organisational controls (37) — A.5.1 to A.5.37: policies, governance, supplier relationships
• People controls (8) — A.6.1 to A.6.8: screening, terms, awareness, disciplinary
• Physical controls (14) — A.7.1 to A.7.14: secure areas, equipment, clear desk
• Technological controls (34) — A.8.1 to A.8.34: access control, cryptography, secure development, monitoring

Eleven controls are entirely new in the 2022 revision. If you are migrating from a 2013-era SoA, these are the ones auditors will check first because they are obvious omissions.

• A.5.7 Threat intelligence
• A.5.23 Information security for use of cloud services
• A.5.30 ICT readiness for business continuity
• A.7.4 Physical security monitoring
• A.8.9 Configuration management
• A.8.10 Information deletion
• A.8.11 Data masking
• A.8.12 Data leakage prevention
• A.8.16 Monitoring activities
• A.8.23 Web filtering
• A.8.28 Secure coding

A justification of "not applicable — no cloud usage" will be rejected if auditors find your team uses Microsoft 365. Justifications must be evidence-backed, dated, and reviewed annually.

• Format: "<Control reference> is <included/excluded> because <specific business reason backed by evidence>. Implementation owner: <named role>. Last reviewed: <date>."
• Include cross-references to policies, procedures and records that implement the control
• Mark implementation status: Implemented / Partially implemented / Planned / Not applicable
• Document evidence locations (file paths, ticket IDs, policy versions)

Our SoA template is a structured XLSX with all 93 Annex A controls, pre-filled implementation guidance for typical SME stacks (Microsoft 365 + Bitdefender + Azure AD), and a mapping to common related frameworks (NIS2, GDPR, SOC 2). It cuts SoA preparation from 80 hours to roughly 16 hours.

• Format: XLSX with conditional formatting and validation
• Pre-filled justifications for 60+ common SME scenarios
• Cross-mapped to NIS2 Article 21, GDPR Articles 5/32, SOC 2 CC series
• Free to download — used in 40+ certified SME ISMS deployments