Build the Statement of Applicability
Set Annex A applicability and implementation status, record justification and link Policies, Risks and evidence to the organisation's compliance position.
Purpose of the Statement of Applicability
The Statement of Applicability records which ISO 27001 Annex A Controls apply to the ISMS, why they apply or do not apply, their implementation status and the supporting governance context.
1. Set Control applicability and status
Open the Statement of Applicability and review each Annex A Control. Mark it Applicable or Not Applicable, record the justification and maintain the implementation status such as Not Started, Planned, In Progress or Implemented.
2. Link Policies, Risks and evidence
Use explicit links to show the governance context behind the SoA position.
- Link a Policy when it defines the organisation's required behaviour or management expectation.
- Link a relevant Risk when it explains the exposure, treatment or rationale connected to the Control.
- Link evidence that demonstrates the operating activity or result being relied upon.
These relationships improve traceability; they do not automatically change the SoA implementation status.
3. Review the complete SoA
Review applicable and not-applicable totals, implementation status, owners, target dates, missing justification and supporting links. Use the SoA change history or review process to preserve material changes to the compliance position.
4. Use Control Management for operational assurance
When the question is whether a Control is adopted, where it applies operationally, whether it is implemented on an Asset, or whether assessments/tests support effectiveness, open Control Management. Do not use the SoA row as a replacement for those assurance records.
Evidence quality
Common problems
A Control marked Not Applicable cannot be saved
Provide a meaningful justification and complete any other required SoA fields before saving.
A Policy is not available to link
Confirm that the document is in an eligible governed state and that your role can access it.
The SoA says Implemented but operational assurance is incomplete
Review the organisation Control in Control Management. SoA status and Control assurance are related but separate records and should be reconciled rather than assumed to be identical.