Risk & compliance
What is a Statement of Applicability (SoA)?
Also known as: SoA, ISO 27001 SoA
A Statement of Applicability is the ISO 27001 document that lists every Annex A control, states whether it is applied or excluded, gives the justification and records its implementation status.
Clause 6.1.3 of ISO 27001 requires it. Auditors use the SoA to trace each control back to the risks it treats and forward to the evidence that it works, so a good SoA links controls to the risk register.
How Clateway helps
- GRC and compliance software with AI – AI-powered GRC software: generate ISO 27001, NIS2, DORA and GDPR policies, run your Statement of Applicability, controls, audit findings and management review in one place.
- ISO 27001 risk register and risk assessment – An ISO 27001 risk register with heat maps, risk appetite, treatment plans, acceptances and AI suggestions from your own systems, vulnerabilities and vendors.