Statement of Applicability

This is the help text the console shows in the help panel on this page.

Statement of Applicability (SoA)

The Statement of Applicability is a mandatory ISO 27001 document that records your organization’s decision on each of the 93 Annex A controls — whether each control is applicable to your ISMS and why.

Control Entries

Each row shows the control, whether it is Applicable or Not applicable, the Justification, and a Status (Draft, Review or Approved). A warning icon in the Flags column means the AI spotted a possible mismatch worth a human look; hover over it for the reason. Click a row’s arrow to expand it and edit:

• Applicable: Yes or No
• Status: Draft, Review or Approved
• Justification: Why the control is included or excluded
• Implementation Notes: How the control is implemented in your environment

Changes save as you edit. Owners and Managers can edit entries.

Generating the SoA

Click Generate SoA to have AI draft applicability decisions and justifications from your ISMS scope and risk register. Review each entry before signing.

Signing & Locking

When all entries are reviewed, click Sign SoA and confirm with Confirm & Sign. A signed SoA is locked and can be exported with the PDF button.

Auditor Expectations

The SoA is typically the first document an ISO 27001 auditor requests. It must account for all 93 controls and provide documented justification for any exclusions.