ISO/IEC 27001:2022: the Statement of Applicability, what it contains and where audits find issues

What it is

The Statement of Applicability (SoA) is documented information required by clause 6.1.3 d) of ISO/IEC 27001:2022. It links risk treatment to controls: for each Annex A control it states whether it is applied, why, and what its status is.

In a certification audit it is the document the auditor starts from to plan the testing of controls. The certificate often refers to the SoA version in force.

What it must contain: clause 6.1.3 d)

• The necessary controls, determined in risk treatment (clauses 6.1.3 b and c).
• The justification for their inclusion.
• Whether the necessary controls are implemented or not.
• The justification for excluding each Annex A control not adopted.

Where the controls come from

The sequence in the standard is: risk assessment (6.1.2), selection of treatment options (6.1.3 a), determination of the necessary controls (6.1.3 b), comparison with Annex A to verify that no necessary controls have been omitted (6.1.3 c), SoA (6.1.3 d), risk treatment plan (6.1.3 e), approval of the plan and acceptance of residual risks by risk owners (6.1.3 f).

Controls may come from any source. Annex A is not exhaustive: a control required by a contract, a sector regulation or the risk assessment belongs in the SoA even if it does not match an Annex A control.

The structure of Annex A 2022

The 2013 edition had 114 controls in 14 domains. The 2022 revision merged existing controls and introduced 11 new ones, including threat intelligence (5.7), information security for use of cloud services (5.23), ICT readiness for business continuity (5.30), configuration management (8.9), information deletion (8.10), data masking (8.11), data leakage prevention (8.12), monitoring activities (8.16) and secure coding (8.28).

ISO/IEC 27002:2022 assigns attributes to each control (for example control type and information security properties). They are not mandatory in the SoA, but they can be used as columns for filtering and sorting.

Exclusions: when they are justified

• A valid justification rests on the outcome of the risk assessment, on the scope of the management system or on the absence of the activity the control refers to.
• Example: an organisation with no in-house software development may justify excluding the secure development controls, but if it outsources development, the outsourced development control (8.30) still applies.
• "Not applicable" without a reason is not a justification.
• Cost does not justify an exclusion if the risk calls for the control: in that case the risk is being accepted, which must be approved by the risk owner and documented as such.

Frequent SoA findings

• SoA inconsistent with the risk treatment plan: controls cited in the plan missing from the SoA, or the reverse.
• Exclusions justified with "not applicable" or with generic wording repeated for every control.
• Controls declared implemented without evidence to support it.
• Implementation status not updated after changes to systems, vendors or scope.
• References still using the Annex A 2013 numbering.
• Additional controls not found in Annex A left out.
• Document version, date and approval not recorded.
• SoA scope different from the stated management system scope.

Review checklist

• All 93 Annex A 2022 controls are listed, each with an inclusion or exclusion decision.
• Each inclusion refers to one or more risks or to an external obligation.
• Each exclusion has a specific justification.
• Implementation status is stated for each included control and matches the available evidence.
• Additional controls from other sources are listed.
• The SoA is consistent with the risk treatment plan and the scope.
• Version, date, author and approval are recorded; the SoA is reviewed after every relevant change and every new risk assessment.

In EVIDEVO

In Controls and compliance the applicability, justification and status of each control are recorded on the control itself, linked to risks in Risk management and to evidence. The Statement of Applicability is exported from this data.