ISO/IEC 27001 · Statement of Applicability

A clear Statement of Applicability, justified and linked to evidence

ConformityAgent helps structure a draft Statement of Applicability for ISO/IEC 27001: applicable controls, non-applicable controls, justifications, implementation status, links to risks, and supporting evidence.

The SoA is not only a control list. It is the document that shows why certain controls are relevant to the organization, how risks are treated, and which evidence can support the decisions made.

Request SoA support View ISO 27001 risk assessment

ISO/IEC 27001

ISO/IEC 27001:2022 + Amd 1:2024 readiness structure

Control / area
Applicability
Justification
Associated risks

SoA

What is a Statement of Applicability?

The Statement of Applicability, or SoA, is the document that explains which security controls are applicable to the organization, which controls are not applicable, why these decisions were made, and what the implementation status is. For ISO/IEC 27001, the SoA should be consistent with the risk assessment, risk treatment plan, and available evidence.

Applicability

For each relevant control, the organization clarifies whether it is applicable, partially applicable, or not applicable in its context.

Justification

Decisions should not be arbitrary. Each inclusion or exclusion should have a clear explanation linked to risks, context, processes, or external requirements.

Evidence

The SoA should indicate where evidence can be found: policies, procedures, registers, technical screenshots, reports, contracts, or other supporting documents.

Why the SoA matters

A well-structured SoA shows that the organization is not checking controls generically, but making explicit decisions based on risks, context, and security objectives. For management, the SoA becomes a map of implemented controls and areas that still require work.

Connection to risks

Controls should be justified by risks, requirements, or management decisions.

Audit clarity

A coherent SoA supports discussions with consultants, auditors, or certification bodies.

Internal tracking

Control status, evidence, and remaining actions can be tracked in a shared structure.

Avoiding duplicated work

The same evidence can be reused for ISO/IEC 27001, NIS2, and other security requirements.

What a useful SoA structure contains

ConformityAgent does not replace the official standard and does not copy the control text. We help structure a working matrix that can be reviewed by management, consultants, auditors, or certification bodies.

Field	Role
Control / area	Identifies the analyzed control area without reproducing the official standard text.
Applicability	Indicates whether the area is applicable, partially applicable, or not applicable.
Justification	Explains why the control is relevant or why it does not apply in the organization’s context.
Associated risks	Links the control to identified risks or risk treatment decisions.
Implementation status	Shows whether the measure is not implemented, partially implemented, implemented, or periodically reviewed.
Owner	Indicates the person or role responsible for maintaining the control.
Evidence	Links the control to policies, procedures, registers, technical exports, screenshots, reports, or contracts.
Open gaps	Shows what is missing, what must be clarified, and which actions need tracking.

Control areas followed

During SoA preparation, controls can be practically grouped into organizational, people, physical, and technological areas. This structure helps divide responsibilities and identify relevant evidence.

Organizational

policies, roles, risk management, suppliers, incidents, continuity, internal compliance

People

responsibilities, training, confidentiality, onboarding, role changes, offboarding

Physical

physical access, site security, equipment, monitoring, workplace protection

Technological

logical access, authentication, backup, logging, vulnerabilities, configurations, encryption, endpoint protection

How ConformityAgent helps

Our process turns answers, risks, and evidence into a SoA structure that can be used in ISO/IEC 27001 preparation.

We clarify the ISMS scope

We determine which processes, locations, systems, teams, and services are included in the analyzed scope.

We start from risks

We use the risk assessment to identify which controls make sense in the organization’s context.

We structure applicability

We mark areas as applicable, partially applicable, or not applicable and prepare clear justifications.

We map evidence

We link each control area to documents, procedures, registers, screenshots, or other existing evidence.

We identify gaps

We highlight where evidence is missing, where status is unclear, and which actions should be prioritized.

We prepare the draft SoA

We deliver a working structure that can be internally reviewed and discussed with consultants, auditors, or certification bodies.

Connection with risk assessment

The Statement of Applicability should be connected to the risk assessment. Risks show what needs protection and why. The SoA shows which controls are relevant, how they are justified, and which evidence supports their implementation.

View risk assessment page

ISMS scope Risk assessment Risk treatment Applicable controls Evidence Draft SoA

Possible deliverables

Depending on the selected package, SoA support can be delivered as an initial assessment, a working matrix, or an advanced package linked to risks and evidence.

Initial applicability view

relevant control areas
high-level observations
initial required evidence
visible gaps
prioritized recommendations

Working SoA matrix

applicability
justification
implementation status
owner
evidence
open gaps

Risk-control-evidence mapping

link to the risk register
link to risk treatment
mapping to evidence
recommended actions
tracking status

Advanced ISO 27001 package

draft Statement of Applicability
evidence completeness review
corrective action register
management review preparation
support for discussions with auditors or certification bodies

Who this is for

organizations preparing for ISO/IEC 27001 that need a clear SoA structure
SMEs that have policies and technical controls but do not yet have a coherent applicability map
companies that must show customers or partners that they have a structured approach
teams that want to connect risks, controls, and evidence in one register
organizations that want to connect ISO/IEC 27001 with NIS2

What the ConformityAgent SoA is not

Statement of Applicability support does not represent ISO/IEC 27001 certification, accredited audit, legal opinion, or a guarantee of compliance. A draft SoA should be reviewed and approved by the organization, and formal certification should be discussed with auditors or certification bodies. ConformityAgent helps structure information, map evidence, and prepare working documents.

Do you want to prepare the SoA structure?

We can start from an ISO 27001 readiness check or from an advanced package that connects risks, controls, evidence, and the Statement of Applicability.

Request ISO 27001 support View pricing