Which Annex A controls have been selected
Selecting information-security controls is one of the most important decisions made during ISO 27001 implementation. A common misconception is that every organisation needs to implement all 93 Annex A controls.
ISO 27001 instead follows a risk-based approach.
The Statement of Applicability records which controls have been selected, which have been excluded, the justification for those decisions and how applicable controls have been implemented.
It therefore creates the connection between the Information Security Risk Assessment, the Risk Treatment Plan and the controls operating within the ISMS.
For both management and certification auditors, the SoA is one of the central documents explaining the organisation’s control strategy.
Which Annex A controls have been selected
Which controls have been excluded
The justification for those decisions
It links the results of the Information Security Risk Assessment to the Risk Treatment Plan and ultimately to the Annex A controls that have been implemented.
It is a practical management tool that helps organisations understand their security posture, communicate control decisions, support governance and maintain consistency as the Information Security Management System evolves.
In reality, ISO 27001 follows a risk-based approach, meaning organisations select only those controls that are appropriate for their identified information security risks, legal obligations and business objectives.
In this guide, you'll learn:
The Statement of Applicability is one of the most important documents within an ISO/IEC 27001:2022 Information Security Management System.
In simple terms, it explains which information security controls your organisation has chosen to implement, which controls have been excluded and why those decisions have been made.
Rather than being a checklist of every Annex A control, the SoA demonstrates that control selection has been based on a structured Information Security Risk Assessment and Risk Treatment process.
Think of the Statement of Applicability as the document that tells the story behind your security controls.
It shows that each control has been selected because it addresses an identified information security risk or fulfils a legal, regulatory or contractual requirement, not because it was copied from a template or implemented without justification.
The primary purpose of the SoA is to provide documented evidence that the organisation has taken a risk-based approach to information security.
It records:
This information provides management, auditors and other interested parties with confidence that the organisation's Information Security Management System has been developed systematically and that security controls are aligned with actual business risks.
One of the easiest ways to understand the Statement of Applicability is to see it as the bridge between identifying risks and implementing controls.
The relationship looks like this:
Without the SoA, it would be difficult to demonstrate why specific controls have been implemented or why others have not.
This is why the Statement of Applicability is often regarded as the central document linking the organisation's Risk Assessment to its Annex A control selection.
Many organisations mistakenly view the Statement of Applicability as something created solely for certification audits.
In reality, it is an important management tool.
An effective SoA helps organisations to:
As new risks emerge or business operations change, the SoA should be reviewed and updated to ensure it continues to reflect the organisation's current risk profile and security objectives.
The Statement of Applicability is one of the key pieces of documented information required by ISO/IEC 27001:2022.
Certification auditors rely heavily on the SoA to verify that the organisation has selected Annex A controls based on identified information security risks rather than implementing controls arbitrarily.
Because of its importance, it is widely regarded as one of the cornerstone documents of an effective Information Security Management System.
No two organisations will have identical Statements of Applicability.
A financial institution, software company, healthcare provider and manufacturer all face different information security risks, legal obligations and business objectives.
As a result, each organisation will select a different combination of Annex A controls.
For example:
This flexibility is one of ISO 27001's greatest strengths.
Instead of prescribing a one-size-fits-all set of security controls, the standard allows organisations to develop an Information Security Management System that reflects their own operating environment and risk profile.
The Statement of Applicability is much more than a mandatory ISO 27001 document.
It is one of the most valuable management tools within an Information Security Management System because it demonstrates how an organisation has translated the results of its Information Security Risk Assessment into practical security controls.
Rather than simply listing which Annex A controls have been implemented, the SoA provides the rationale behind those decisions, showing that the organisation has adopted a structured, risk-based approach to information security.
One of the fundamental principles of ISO/IEC 27001:2022 is that information security controls should be selected based on risk.
The Statement of Applicability provides documented evidence that this principle has been applied.
It shows that the organisation has:
This helps demonstrate that security decisions have been made systematically rather than by applying a generic checklist or template.
During an ISO 27001 certification audit, the Statement of Applicability is one of the first documents an auditor is likely to review.
Auditors use the SoA to verify that:
Because the SoA links the Risk Assessment to the implemented controls, it provides auditors with a clear roadmap for evaluating the effectiveness of the Information Security Management System.
As organisations grow, information security controls often become distributed across multiple policies, procedures, systems and departments.
The Statement of Applicability brings these decisions together into a single, structured document.
It provides a consolidated view of:
This makes the SoA a valuable reference for management, Internal Auditors, implementation teams and certification auditors.
Good governance requires clear decisions and documented accountability.
The Statement of Applicability supports this by recording not only which controls have been selected, but also the business justification behind those decisions.
This enables senior management to understand:
Information security controls should not remain static.
New technologies, emerging cyber threats, organisational changes and updated legal or contractual requirements may all affect which controls are appropriate.
The Statement of Applicability provides a structured framework for reviewing and updating control decisions over time.
The Statement of Applicability helps stakeholders understand:
This improves communication and creates a shared understanding of the organisation's information security strategy.
Keeping the SoA current helps organisations:
A well-maintained SoA helps organisations:
The Statement of Applicability is a mandatory component of an ISO/IEC 27001:2022 Information Security Management System.
Although the standard specifies what the SoA must achieve, it does not prescribe a fixed template or format.
Organisations are free to structure the document in a way that best suits their business, provided it contains the required information and accurately reflects their Information Security Management System.
During certification audits, the SoA provides evidence that the organisation has selected information security controls through a structured Information Security Risk Assessment and Risk Treatment process rather than implementing controls arbitrarily.
Without an accurate and up-to-date Statement of Applicability, organisations may find it difficult to demonstrate how their implemented controls address identified information security risks.
The process should follow a logical sequence:
Each control included within the SoA should have a clear business justification that can be traced back to identified information security risks, legal obligations or contractual requirements.
Every Statement of Applicability should identify:
Many organisations also include:
These additions can make the document more useful as an operational management tool.
For each control, the organisation should determine whether it is:
Where a control is excluded, the organisation should provide a clear justification explaining why it is not relevant within the scope of the Information Security Management System.
Updates may be required following:
At a minimum, the Statement of Applicability should identify:
Many organisations also include:
Every control included within the Statement of Applicability should have a clear justification.
Typical reasons include:
A weak justification might be:
"Required by ISO."
A stronger justification would explain the business reason, for example:
A control should only be excluded where there is a valid business reason.
Examples may include:
Every exclusion should be documented with sufficient justification to demonstrate that the decision resulted from the Risk Assessment and Risk Treatment process.
Depending on the control, supporting documentation may include:
Referencing these documents makes it easier for Internal Auditors and certification auditors to verify implementation.
An effective SoA should be:
Developing an effective Statement of Applicability is the culmination of several key activities within an Information Security Management System.
The Risk Assessment identifies:
Without a completed Risk Assessment, there is no objective basis for developing a Statement of Applicability.
Typical Risk Treatment options include:
The Risk Treatment Plan documents these decisions and identifies the controls required to reduce identified risks to an acceptable level.
ISO/IEC 27001:2022 includes 93 Annex A controls grouped into four themes:
Each control should be reviewed individually to determine whether it is applicable.
For every applicable control, the organisation should understand:
Good justifications should be:
Many organisations use simple status indicators such as:
Before approval, confirm that:
The completed SoA should then be reviewed and approved in accordance with the organisation's document control process.
The Statement of Applicability should remain a living document throughout the lifecycle of the Information Security Management System.
It should be reviewed whenever significant changes occur.
Simply marking controls as "Yes" or "No" does not demonstrate why those decisions have been made.
The purpose of the SoA is to explain why each control has or has not been selected based on the organisation's Information Security Risk Assessment and Risk Treatment process.
Templates can provide a useful starting point, but they should never replace the organisation's own Risk Assessment and decision-making process.
Every organisation has different:
Generic statements such as:
provide little evidence that the control selection process was based on identified risks.
Each justification should explain the business reason behind the decision.
Simply stating "Not applicable" is rarely sufficient.
The organisation should explain why the control does not apply within the defined scope of the Information Security Management System.
Changes that may require updates include:
Problems arise when:
A well-developed SoA should create a clear and logical line of sight from identified risks through to implemented controls.
Each applicable control should be supported by documented information such as:
When used effectively, the SoA supports:
Organisations should focus on creating a document that is:
The SoA shows that each control has been selected to address identified information security risks, legal obligations or business requirements.
A clear, accurate and well-maintained SoA helps certification auditors understand:
The Statement of Applicability provides senior management with a consolidated view of the organisation's information security controls and the reasoning behind key security decisions.
The Statement of Applicability provides a single reference point that records:
Internal Auditors and certification auditors can use the SoA as a roadmap to understand:
Regularly updating the SoA helps organisations:
The SoA provides evidence that:
A well-maintained SoA supports:
Implementing ISO/IEC 27001 is about much more than completing documentation or passing a certification audit.
A successful Information Security Management System requires a structured approach that aligns information security with your organisation's risks, business objectives and day-to-day operations.
Our ISO 27001 consultancy services include:
We help organisations develop SoAs that:
Whether you operate in:
the Information Security Management System and Statement of Applicability should reflect your specific risks, operational environment and certification objectives.
An effective Information Security Management System should help your organisation:
Depending on your requirements, ISO Specialist South Africa can support:
Training offerings should be confirmed against ISO Specialist South Africa's current service catalogue before publication.
Certification bodies are responsible for independently auditing and certifying your Information Security Management System.
ISO Specialist South Africa's role is different.
We help you design, implement and prepare your ISMS for certification so that you are ready for an independent audit by the certification body of your choice.
A Statement of Applicability is a mandatory document within an ISO/IEC 27001 Information Security Management System.
It records:
The Statement of Applicability is required by ISO/IEC 27001:2022 and is one of the key documents reviewed during certification audits.
Every Annex A control should be considered, but not every control will necessarily apply to every organisation.
Controls that are not applicable may be excluded, provided there is a clear and documented business justification.
The Risk Treatment Plan explains how identified information security risks will be managed.
The Statement of Applicability records which Annex A controls have been selected to support those treatment decisions and why they were chosen.
The Statement of Applicability should be developed after the organisation has:
Responsibility varies between organisations.
It may be maintained by:
Regardless of who maintains it, senior management should ensure that it remains accurate, current and aligned with the Information Security Management System.
There is no fixed review period specified by ISO 27001.
It should be reviewed whenever significant changes occur, including:
Many organisations also review the SoA as part of their annual ISMS review cycle.
Many organisations maintain their SoA in a spreadsheet because it is simple to update and easy to present during audits.
Others use Governance, Risk and Compliance platforms or dedicated ISMS software.
Regardless of the format, the document should remain controlled, version managed and aligned with the organisation's document control process.
It may:
Certification auditors typically review the Statement of Applicability early in the audit process because it provides an overview of the organisation's control environment.
ISO 27001 does not prescribe a specific format, but many organisations reference supporting documentation within the Statement of Applicability.
Examples include:
ISO 27001 certification does not automatically demonstrate compliance with POPIA.
However, where POPIA requirements influence the organisation's Information Security Risk Assessment, the SoA can demonstrate how appropriate Annex A controls have been implemented to support the protection of personal information, strengthen governance and meet contractual or regulatory expectations.
Understand ISO 27001 → Define the ISMS Scope → Conduct a Gap Analysis → Perform a Risk Assessment → Develop the Risk Treatment Plan → Select Annex A Controls → Create the Statement of Applicability → Implement Controls → Conduct Internal Audits → Management Review → Certification Audit → Continual Improvement
The Statement of Applicability is far more than a mandatory ISO/IEC 27001 document.
It is one of the cornerstones of an effective Information Security Management System, providing a clear and documented link between your organisation's Information Security Risk Assessment, Risk Treatment decisions and the Annex A controls implemented to protect your information assets.
A well-developed Statement of Applicability delivers value far beyond certification.
It supports stronger governance, simplifies Internal and certification audits, improves accountability, facilitates continual improvement and helps organisations maintain an Information Security Management System that evolves alongside changing business needs, technologies and cyber threats.
The Statement of Applicability should never be viewed as a document that is completed once and then forgotten.
Regularly reviewing and updating it helps ensure that it continues to reflect:
A practical, well-maintained SoA helps organisations:
ISO Specialist South Africa can assist with:
Whether you are implementing ISO 27001 for the first time, preparing for certification or improving an existing Information Security Management System, we can help you develop a practical, risk-based and audit-ready Statement of Applicability aligned with your organisation's business objectives.
:::