QULDEXResources · Glossary
What is a Statement of Applicability (SoA)?
What is the Statement of Applicability for?
After assessing risks you choose controls to treat them. The standard then asks you to compare your choice with Annex A, so that no necessary control has been overlooked. The SoA records the result.
It is one of the first documents a certification auditor asks for, because it states what you claim to do. The audit then tests whether the claims are true.
What must the SoA contain?
Whether the control is necessary for your organisation.
The reason for including it, such as a risk, a law or a contract, or the reason for excluding it.
Whether the control is in place, with a pointer to how.
What does an SoA row look like?
Three rows from a Statement of Applicability.
| Control | Decision and justification |
|---|---|
| A.5.15 Access control | Included. Treats risks R-04 and R-11; required by customer contracts. Implemented: access control policy v3. |
| A.8.13 Information backup | Included. Treats risk R-07. Implemented: backup procedure and monthly restore test. |
| A.7.4 Physical security monitoring | Excluded. The organisation has no premises of its own; staff work remotely and hosting is with a cloud provider. |
This is an illustration written for this page, not a customer record.
Where is the SoA required?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Clause 6.1.3 d) | Produce a Statement of Applicability with the necessary controls, justification for inclusion, implementation status, and justification for excluding Annex A controls. |
| ISO 27001 | Clause 6.1.3 c) | Compare the controls you determined with Annex A and verify that no necessary controls have been omitted. |
| ISO 27701 | Privacy controls | A similar statement is produced for the privacy controls that apply. |
| ISO 42001 | Clause 6.1.3 | A statement of applicability is produced for the AI management system controls. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What do auditors find wrong with SoAs?
Exclusions without a reason
A control is marked 'not applicable' with nothing more.
Instead: give a specific justification for every exclusion.
Everything included by default
All 93 controls are marked applicable to be safe, including ones that cannot apply.
Instead: decide each control on your risks and context.
Out of date
The SoA has not changed since certification, though the systems have.
Instead: review it when risks or scope change.
How does QULDEX handle this?
Controls arrive already mapped across frameworks, each with an owner and a status.
Statement of Applicability: common questions
Is the Statement of Applicability mandatory for ISO 27001?
Yes. Clause 6.1.3 d) requires it, and it must be kept as documented information.
Can you exclude Annex A controls?
Yes, if a control is not necessary for your organisation. Each exclusion needs a justification that an auditor can assess.
Does the SoA have to list controls outside Annex A?
It lists all the controls you determined to be necessary, whatever their source. Annex A is the reference you check against, not the limit.
Applicability, justification and status for every control
Controls, evidence, findings and corrective actions in one audit workspace.