A Statement of Applicability (SoA) is a critical document required for ISO compliance, particularly in ISO 27001—the standard for Information Security Management Systems (ISMS). The SoA serves as a key reference that outlines which controls from Annex A of ISO 27001 are applicable to an organization and justifies their inclusion or exclusion. Creating an effective SoA template ensures a structured approach to compliance, making audits and reviews more efficient.
This guide will walk you through the importance of an SoA, the essential components, and step-by-step instructions for developing a robust template for your organization’s ISO compliance efforts.
Understanding the Statement of Applicability
What Is an SoA?
The Statement of Applicability (SoA) is a document that lists:
- All 114 controls from Annex A of ISO 27001:2022 (or relevant controls for other ISO standards)
- The status of each control (applicable or not applicable)
- Justification for inclusion or exclusion
- The implementation status of the control
- References to relevant policies, procedures, and documents
Why Is an SoA Important?
The SoA is crucial because it:
- Serves as evidence of compliance during an ISO certification audit
- Helps organizations assess and manage risks
- Provides clarity on security controls implemented in the ISMS
- Ensures alignment with legal, regulatory, and contractual requirements
Essential Components of an SoA Template
A well-structured SoA template should include the following sections:
1. Introduction and Scope
- Define the purpose of the SoA
- Specify the scope of the ISMS, including business functions, locations, and systems covered
- Mention any relevant standards (e.g., ISO 27001:2022, ISO 9001, ISO 22301, etc.)
2. Control Reference
- List each control from Annex A of ISO 27001
- Include a unique identifier for each control (e.g., A.5.1, A.6.2, etc.)
3. Applicability Status
- Clearly indicate whether a control is applicable or not
- If not applicable, provide justification (e.g., "This control is not relevant as we do not process financial transactions.")
4. Justification for Inclusion or Exclusion
- Explain why the control is included in the ISMS
- Provide risk assessment results that support inclusion
5. Implementation Status
- Define the status of control implementation, such as:
- Implemented – Fully in place
- Partially Implemented – Under development
- Not Implemented – Yet to be developed
6. References to Supporting Documentation
- Link relevant policies, procedures, and risk assessment reports
- Provide document names, reference numbers, or hyperlinks for quick access
7. Review and Approval
- Include details of the responsible personnel (e.g., CISO, Compliance Manager)
- Mention the approval date and schedule for periodic reviews
Step-by-Step Guide to Creating an SoA Template
Step 1: Define the Scope of the SoA
- Identify business units, processes, and locations covered under the ISMS
- Align with the organization’s risk assessment and business objectives
Step 2: List Annex A Controls
- Extract the 114 controls from Annex A of ISO 27001
- Organize them in a structured tabular format
Step 3: Assess Applicability of Each Control
- Perform a risk assessment to determine whether each control is needed
- Justify inclusion or exclusion based on business context and risk landscape
Step 4: Determine Implementation Status
- Assess whether controls are fully implemented, partially implemented, or not implemented
- Identify gaps and areas for improvement
Step 5: Link to Relevant Documents
- Reference supporting policies such as:
- Information Security Policy
- Access Control Policy
- Incident Management Procedure
- Risk Assessment Reports
Step 6: Obtain Approval and Maintain the SoA
- Have the CISO, Compliance Officer, or Top Management review and approve the SoA
- Schedule regular reviews (at least annually or after major changes in the ISMS)
Best Practices for Creating an Effective SoA
- Align with Risk Assessment: Ensure each control is selected based on identified risks.
- Be Clear and Concise: Keep justifications simple but well-documented.
- Ensure Consistency: Align with existing policies, procedures, and ISO documentation.
- Keep It Up to Date: Regularly review and revise based on business changes.
- Make It Audit-Friendly: Structure it so auditors can easily verify compliance.
Conclusion
Creating a Statement of Applicability (SoA) template is a vital step for achieving ISO compliance. A well-structured SoA simplifies audits, clarifies control implementation, and ensures alignment with risk management practices. By following the steps outlined in this guide, organizations can develop an effective SoA that supports their information security and compliance goals.
Regular updates and alignment with business needs will ensure your SoA remains relevant and useful in maintaining ISO compliance.