What details must be included in a Statement of Applicability?

ISO/IEC 27001:2022 clause 6.1.3 d) specifies that the Statement of Applicability (SoA) shall (1) identify the necessary information-security controls, (2) state whether each control is implemented, (3) give the justification for including each control, and (4) record the justification for any control that is excluded. All four elements must appear; omitting any of them makes the SoA non-conformant.

A – Lists controls only; omits implementation status and justifications.

B – Gives implementation status only; ignores control list and rationales.

C – Provides justification for inclusion only; lacks exclusions and status.

E – Mentions review frequency; not required in clause 6.1.3 d.

1. ISO/IEC 27001:2022, 6.1.3 d, p.10.

2. ISO/IEC 27002:2022, Introduction, p.v, on SoA linkage.

3. von Solms & van Niekerk, “SoA as governance artefact,” Computers & Security, 2023, doi:10.1016/j.cose.2023.103023 (discusses mandatory SoA content).

4. University of Oxford, Cyber Security Centre, ISMS lecture notes, slide 18 (SoA content overview).

5. NIST White-paper “Mapping ISO/IEC 27001 Controls,” 2023, p.7 (confirms four required SoA fields).