# Statement of Applicability
URL: https://docs.autociso.io/console/iso/soa/
Description: The Statement of Applicability is a mandatory ISO 27001 document that records your organization's decision on each of the 93 Annex A controls — whether each control is applicable to your ISMS and why.

*This is the help text the console shows in the help panel on this page.*

## Statement of Applicability (SoA)

The Statement of Applicability is a mandatory ISO 27001 document that records your organization's decision on each of the 93 Annex A controls — whether each control is applicable to your ISMS and why.

### Control Entries
Each row shows the control, whether it is **Applicable** or **Not applicable**, the **Justification**, and a **Status** (Draft, Review or Approved). A warning icon in the Flags column means the AI spotted a possible mismatch worth a human look; hover over it for the reason. Click a row's arrow to expand it and edit:
- **Applicable**: Yes or No
- **Status**: Draft, Review or Approved
- **Justification**: Why the control is included or excluded
- **Implementation Notes**: How the control is implemented in your environment

Changes save as you edit. [Owners and Managers](https://docs.autociso.io/getting-started/roles-and-permissions/) can edit entries.

### Generating the SoA
Click **Generate SoA** to have AI draft applicability decisions and justifications from your [ISMS scope](https://docs.autociso.io/console/iso/scope/) and [risk register](https://docs.autociso.io/console/iso/risk-register/). Review each entry before signing.

### Signing & Locking
When all entries are reviewed, click **Sign SoA** and confirm with **Confirm & Sign**. A signed SoA is locked and can be exported with the **PDF** button.

### Auditor Expectations
The SoA is typically the first document an [ISO 27001 auditor](https://docs.autociso.io/console/iso/auditor-portal/) requests. It must account for all 93 controls and provide documented justification for any exclusions.