Templates and records · ISO 27001 · Clause 6.1.3
ISO 27001 statement of applicability template
The document that links the risk assessment to the 93 Annex A controls: which apply, why, which do not and how far along each one is.
In one sentence
The statement of applicability (SoA) is the document that, under clause 6.1.3 d) of ISO/IEC 27001, lists the controls needed to treat risks, justifies their inclusion, states whether they are implemented and justifies every exclusion of an Annex A control; it is the first document the auditor asks for because it defines the real scope of the certification.
- Where the standard requires it
- ISO 27001 · Clause 6.1.3 Clauses follow ISO/IEC 27001:2022; those beginning with “A.” are Annex A controls, required to the extent that the statement of applicability includes them.
- Type of information
- Mandatory document A document required by 6.1.3 d), kept up to date
- Who fills it in
- Information security manager Approved by top management, together with the risk owners
- When
- After every risk assessment And whenever the status of a control or the scope of the system changes
- How long it is kept
- Current and previous versions It is worth keeping the superseded versions from the certification cycle: the auditor compares what has changed and why (7.5.3).
What the standard requires
What ISO 27001 demands and what it leaves to your judgement
Once risks have been assessed, the standard asks you to choose the controls needed to treat them and compare them with Annex A to check that none that is necessary has been left out. The result is formalised in the statement of applicability, which must contain the necessary controls, the justification for including them, whether or not they are implemented and the justification for any exclusions.
The standard does not require all 93 controls to be applied: it requires a decision on every one of them. It also allows your own controls or controls from other frameworks, which are added to the statement alongside those of Annex A.
It is a living document: it changes when the risks, the scope or the implementation status change, and its current version is the one cited on the certificate.
Structure
Fields the template should include
- Control identifier and name (Annex A or another framework)
- Applicable? Yes or no
- Reason for inclusion: risk, legal or contractual requirement
- Reason for exclusion, if not applicable
- Implementation status: implemented, in progress, planned
- Reference to the evidence or the procedure that puts it into practice
- Control owner
- Version, date and approval
Example
Example: three lines from a software company’s SoA
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Organisation | Cloudline Digital Services (fictitious) · SaaS platform · 80 people |
| 5.23 Information security for use of cloud services | Applies · Risk R-07 (hosting provider) and customer contracts · Implemented · Procedure PS-12 |
| 7.4 Physical security monitoring | Applies · Risk R-15 (office access) · In progress: cameras planned for March 2027 |
| 8.30 Outsourced development | Not applicable · All development is in-house; to be reviewed if work is outsourced |
| Own control | NB-01 Review of permissions on the code repository · Applies · Risk R-03 · Implemented |
| Version | v6 · approved by the management committee on 9 September 2026 |
At the audit
Mistakes auditors commonly flag
- Exclusions justified with “not applicable” without saying why.
- Controls marked as implemented with no evidence to back them up.
- The SoA does not cite which risk justifies each control: the link to the assessment is invisible.
- A version different from the one shown on the certificate or in the audit report.
- The 114-control structure of the 2013 edition is still in use.
In Kimobox
How this record is kept in Kimobox
- 1The statement of applicability lists the Annex A controls with their implementation status.
- 2Each control is linked to the evidence that proves it and to the risks it treats.
- 3The statement is a controlled, versioned document: who approved each version, and when, is kept on record.
Frequently asked questions
What people ask us before getting started
Can an Annex A control be excluded?
Yes, provided the exclusion is justified: because the risk does not exist within the scope, because it is treated by another control or because the activity does not take place. What the standard does not allow is ignoring a control without taking a position on it.
Does the ENS SoA work for ISO 27001?
Not directly. The Spanish National Security Framework (ENS) has its own statement of applicability covering the measures in Annex II of Royal Decree 311/2022. Many measures correspond to Annex A controls, and it is worth keeping a cross-reference, but they are two separate documents.
Keep your ISO 27001 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
ENS statement of applicability template
What the ENS statement of applicability must contain: Annex II measures by category, reinforcements…
Planning
Planning in ISO 27001 means analyzing the risk of each asset and deciding, with judgment, which Annex A…
ISO 27001 information security risk assessment template
How to document the information security risk assessment ISO 27001 requires: acceptance criteria, risk…
ISO 27001 risk treatment plan template
What the ISO 27001 risk treatment plan (6.1.3 e) must include: the option chosen, controls, owner, deadline…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO/IEC 27001:2022 — Information security management systems. Requirements ISO/IEC · 25 October 2022
- ISO/IEC 27002:2022 — Information security controls ISO/IEC · February 2022