Guide 02 · Step 3 of 5
Write the Statement of Applicability
The SoA is the most-read document in your audit pack. It is also the one most often filled in carelessly.
Independent guidance from Synergy. ISO/IEC 27001 and ISO 22301 are published by ISO/IEC, which has no affiliation with Synergy and has not reviewed this material. This material is provided for informational purposes only and does not constitute compliance or legal advice. Always work from the published text of the standard.
The Statement of Applicability (SoA) is required by clause 6.1.3. It lists every Annex A control, says whether it applies, and justifies the answer. Annex A of ISO/IEC 27001:2022 contains 93 controls in four themes: organisational (37), people (8), physical (14), and technological (34).
Every one of those 93 gets a line. No exceptions, no "not applicable to us" without a reason.
Exclusion is a claim you have to defend
You may exclude a control. You may not exclude it silently. The justification has to connect back to your risk assessment: we exclude 7.4 because we operate no premises of our own and hold no physical assets beyond end-user laptops covered under 7.9.
What each row needs
- Control reference and name — from the published standard, not from a summary you found online.
- Applicability — applicable, or excluded with a stated reason.
- Justification — tied to a risk in the register, or to a legal or contractual requirement.
- Implementation status — implemented, partially, or planned, with a date and an owner.