Statement of Applicability (SoA) Template

Introduction to the Statement of Applicability

The Statement of Applicability (SoA) is one of the most critical documents in your ISO 27001 implementation. It serves as the bridge between your risk assessment and the actual security controls you implement.

What is a Statement of Applicability?

The SoA is a mandatory document that:

• Lists all 93 controls from ISO 27001:2022 Annex A
• Indicates which controls are applicable to your organization
• Provides justification for controls marked as "not applicable"
• Documents how applicable controls are implemented
• Links controls to identified risks and treatment decisions
• Serves as a master reference for auditors

Why the SoA Matters

For Auditors:

• Primary document reviewed during certification audits
• Demonstrates systematic approach to security control selection
• Shows due diligence in addressing information security risks
• Provides roadmap for evidence collection during audit

For Your Organization:

• Creates accountability for control implementation
• Helps prioritize security initiatives
• Documents compliance decisions
• Facilitates gap analysis and improvement planning
• Ensures alignment between risks and controls

Complete SoA Structure and Template

Document Control Section

STATEMENT OF APPLICABILITY (SoA)
ISO/IEC 27001:2022

Document Information:
- Document Owner: [CISO/Information Security Manager]
- Version: [X.X]
- Last Updated: [Date]
- Next Review Date: [Date]
- Classification: CONFIDENTIAL
- Approval: [Management Representative]

Change History:
| Version | Date | Changes | Approved By |
|---------|------|---------|-------------|
| 1.0 | YYYY-MM-DD | Initial SoA | [Name] |
| 1.1 | YYYY-MM-DD | Updated controls 5.7, 8.9 | [Name] |

Executive Summary Section

## Executive Summary

This Statement of Applicability documents the information security controls
selected for implementation within [Organization Name] to manage identified
information security risks and meet compliance obligations.

### Scope of ISMS
[Your ISMS scope from context establishment]

### Risk Assessment Summary
- Total Risks Identified: [Number]
- High Priority Risks: [Number]
- Risks Requiring Control Implementation: [Number]

### Control Applicability Summary
- Total Annex A Controls: 93
- Applicable Controls: [Number]
- Not Applicable Controls: [Number]
- Implementation Status:
  - Fully Implemented: [Number]
  - Partially Implemented: [Number]
  - Planned: [Number]

Control Applicability Matrix

Organizational Controls (5.1 - 5.37)

People Controls (6.1 - 6.8)

Physical Controls (7.1 - 7.14)

Technological Controls (8.1 - 8.34)

Detailed Implementation Examples

Example 1: APPLICABLE Control with Full Documentation

Control 8.5: Secure Authentication

CONTROL IMPLEMENTATION DETAILS

Status: FULLY IMPLEMENTED
Implementation Date: 2024-02-22
Control Owner: Director of IT Security
Review Date: 2024-08-22

Risk Mapping:
- R-008: Unauthorized access due to weak authentication (HIGH)
- R-046: Account compromise leading to data breach (HIGH)

Implementation Description:
Multi-factor authentication (MFA) has been implemented organization-wide using
Microsoft Azure AD Conditional Access policies. Implementation covers:

1. User Authentication:
   - All employees: MFA required for O365, VPN, and corporate applications
   - Methods supported: Authenticator app (primary), SMS (backup), Hardware token (executives)
   - Self-service enrollment portal available
   - 99.2% enrollment rate achieved

2. Administrative Authentication:
   - Separate admin accounts for all privileged users
   - Phishing-resistant MFA required (FIDO2 security keys)
   - Admin accounts: No exception to MFA policy
   - Admin session timeout: 4 hours

3. Service Accounts:
   - Azure Managed Identities where possible (no passwords)
   - Certificate-based authentication for legacy systems
   - Regular audit of service account authentication methods

4. External Access:
   - B2B guests: MFA required via home tenant or SMS
   - API access: OAuth 2.0 with client certificates
   - VPN: MFA required before tunnel establishment

Technical Controls:
- Conditional Access Policies: 12 policies configured
- Failed auth monitoring: Alert after 5 failed attempts
- Location-based restrictions: Block high-risk countries
- Device compliance: Require managed device for Confidential data access

Evidence References:
- CONFIG-AAD-CA-001: Conditional Access policy export
- DASH-MFA-ENROLLMENT: Current enrollment dashboard
- PROC-MFA-001: MFA enrollment and support procedure
- TRAIN-MFA-USER: User training materials
- TEST-MFA-2024-Q1: MFA bypass testing results

Compliance Mapping:
- GDPR Article 32: Technical measures for security
- NIST CSF: PR.AC-7 (Users, devices, and other assets are authenticated)
- CIS Control 6: Access Control Management
- SOC 2 CC6.1: Logical and physical access controls

Metrics and KPIs:
- MFA Enrollment Rate: 99.2% (Target: >98%)
- MFA Success Rate: 97.8% (Target: >95%)
- Help Desk MFA Tickets: 23/month (Decreasing)
- Admin MFA Compliance: 100%

Gap Analysis: NONE - Control fully implemented

Next Review Actions:
- [ ] Evaluate passwordless authentication (Windows Hello for Business)
- [ ] Assess feasibility of FIDO2 for all users
- [ ] Review MFA bypass requests (currently 4 approved exceptions)

Example 2: NOT APPLICABLE Control with Justification

Control 7.5: Protecting Against Physical and Environmental Threats

CONTROL APPLICABILITY DECISION

Status: NOT APPLICABLE
Decision Date: 2024-01-15
Decision Maker: CISO (John Smith)
Approved By: COO (Jane Doe)
Review Date: 2025-01-15

Risk Assessment:
Risk R-033: "Environmental disaster damages on-premise infrastructure"
- Initial Risk Rating: MEDIUM
- Likelihood: LOW (based on facility location and building standards)
- Impact: MEDIUM (primarily availability impact)

Justification for Non-Applicability:
This control is not applicable to our organization for the following reasons:

1. Minimal On-Premise Infrastructure:
   - 95% of production systems hosted in AWS cloud
   - No company-owned data center facilities
   - No server rooms with environmental control requirements
   - Office server room: Small network equipment closet only (non-critical)

2. Cloud Provider Responsibility:
   - AWS manages environmental controls per Shared Responsibility Model
   - AWS facilities include:
     * Fire suppression systems
     * Redundant HVAC systems
     * Backup power generation
     * Flood protection measures
   - Verified through AWS SOC 2 Type II report

3. Office Environment:
   - Corporate office: Commercial building with standard HVAC
   - Building management responsible for environmental systems
   - No special environmental requirements beyond standard office conditions
   - Network closet: Standard temperature/humidity (adequate for edge equipment)

4. Risk Treatment Decision:
   - Risk R-033 re-assessed with cloud infrastructure: LOW
   - Residual risk ACCEPTED by management
   - No additional controls cost-justified

Alternative Controls Implemented:
While 7.5 is not applicable, environmental risk is addressed through:
- Control 8.14: Redundancy of information processing facilities (Cloud multi-AZ)
- Control 5.30: ICT readiness for business continuity (Cloud DR strategy)
- Control 8.13: Information backup (Geo-redundant backups)

Documentation References:
- RISK-R-033: Risk assessment for environmental threats
- AWS-SOC2-2024: AWS SOC 2 Type II Report
- ARCH-CLOUD-001: Cloud architecture diagram
- DECISION-MEMO-7.5: Management decision memorandum

Contractual Coverage:
- AWS Customer Agreement: Section 4.2 (Service Level Agreement)
- Lease Agreement Office Space: Building environmental systems
- Building Management Agreement: HVAC maintenance schedule

Review Criteria:
This control will be re-assessed as APPLICABLE if:
- Organization builds or leases data center space
- On-premise infrastructure exceeds 20% of compute capacity
- Compliance requirements mandate on-premise data processing
- Business continuity strategy changes to require on-premise DR site

Audit Trail:
| Date | Action | User | Notes |
|------|--------|------|-------|
| 2024-01-10 | Initial Assessment | Security Analyst | Marked as N/A |
| 2024-01-12 | Risk Review | CISO | Confirmed LOW risk |
| 2024-01-15 | Management Approval | COO | Accepted residual risk |
| 2024-01-15 | SoA Updated | ISMS Coordinator | Documented decision |

Control Implementation Summary by Category

Implementation Status Overview

Completion Percentage: 89.2% (83/93 controls fully implemented)

Partially Implemented Controls

Planned Controls (Not Yet Implemented)

Risk-to-Control Mapping

This section maps identified risks to the controls that mitigate them.

Risk Coverage Statistics

• Total Risks Identified: 47
• Risks with Multiple Controls (Defense in Depth): 38 (81%)
• High Risks: 18
  • Fully Mitigated to Low: 11 (61%)
  • Partially Mitigated to Medium: 6 (33%)
  • Accepted: 1 (6%)
• Average Controls per Risk: 2.9

Control-to-Evidence Mapping

This section provides a comprehensive mapping of controls to the evidence that demonstrates their implementation.

Evidence Type Categories

Evidence Collection Schedule

Key Evidence for Audit

Critical Evidence Auditors Will Request:

1. Risk Assessment (R-001 through R-047)

   • Location: SharePoint/ISMS/RiskAssessment/
   • Last Updated: 2024-Q1
   • Format: Excel with risk register, treatment plan

2. Asset Inventory (Control 5.9)

   • Location: CMDB (ServiceNow)
   • Export: REP-ASSET-INVENTORY-2024-Q1.xlsx
   • Records: 1,247 assets with classifications

3. Access Review Evidence (Control 5.18)

   • Location: SharePoint/ISMS/AccessReviews/
   • Files: REP-ACCESS-REVIEW-2024-Q1.pdf (quarterly reviews)
   • Attestations: Signed by data owners

4. Training Records (Control 6.3)

   • Location: LMS (Cornerstone)
   • Report: REP-TRAINING-COMPLETION-2024.pdf
   • Metrics: 95% completion, test scores

5. Incident Log (Controls 5.24-5.27)

   • Location: ServiceNow (Security Incident Module)
   • Export: REP-INCIDENTS-2023-FULL-YEAR.xlsx
   • Records: 47 incidents, all with post-incident reviews

6. Vulnerability Management (Control 8.8)

   • Location: Tenable.io
   • Reports: REP-VULN-SUMMARY-MONTHLY-2024-*.pdf
   • Metrics: MTTR, critical patch compliance

7. Backup Verification (Control 8.13)

   • Location: SharePoint/ISMS/Backups/
   • Files: TEST-RESTORE-2024-Q*.pdf (quarterly restore tests)
   • Status: All tests successful

8. Management Review Minutes (Clause 9.3)

   • Location: SharePoint/ISMS/ManagementReview/
   • Files: MTG-MGMT-REVIEW-2024-Q*.pdf
   • Content: ISMS performance, improvements, objectives

9. Internal Audit Reports (Clause 9.2)

   • Location: SharePoint/ISMS/InternalAudits/
   • Files: REP-INTERNAL-AUDIT-2024-Q*.pdf
   • Findings: Tracked in ServiceNow

10. Control Testing Evidence

    • Location: SharePoint/ISMS/ControlTesting/
    • Format: Testing workbook per control
    • Results: Pass/Fail with screenshots

Legal, Statutory, Regulatory and Contractual Requirements

Compliance Obligations Register

Compliance Mapping Matrix

GDPR Articles to Control Mapping:

PCI DSS Requirements to Control Mapping:

Gap Analysis and Remediation Plan

Current State Assessment

Overall ISMS Maturity: Level 3 - Defined (on 5-level scale)

Identified Gaps

Priority 1 (Critical) - Target completion: Q2 2024

Priority 2 (Important) - Target completion: Q3 2024

Priority 3 (Enhancement) - Target completion: Q4 2024

Remediation Roadmap

Q2 2024 (Apr-Jun)

• ✓ Complete CCTV installation (GAP-003)
• ✓ Finish DAST CI/CD integration (GAP-002)
• ◐ Begin test data masking automation (GAP-004)
• ○ Start vendor security rating integration (GAP-008)

Q3 2024 (Jul-Sep)

• ○ Deploy endpoint DLP (GAP-001)
• ○ Complete test data masking automation (GAP-004)
• ○ Expand SOC monitoring scope (GAP-005)
• ○ Integrate threat feeds (GAP-007)
• ○ Complete vendor security integration (GAP-008)

Q4 2024 (Oct-Dec)

• ○ Upgrade legacy systems to TLS 1.2+ (GAP-006)
• ○ Implement automated evidence collection (GAP-010)
• ○ Evaluate passwordless authentication (GAP-009)
• ○ Expand architecture patterns library (GAP-012)

2025 and Beyond

• Launch bug bounty program (GAP-011)
• Implement passwordless authentication (GAP-009)
• Achieve ISMS Maturity Level 4 across all components
• Pursue additional certifications (SOC 2 Type II, ISO 27017, ISO 27018)

Budget Requirements for Gap Remediation

Continuous Improvement

Control Effectiveness Measurement

Each control is measured using defined KPIs:

Example: Control 8.5 (Secure Authentication)

• KPI 1: MFA enrollment rate (Target: >98%, Current: 99.2%) ✓
• KPI 2: MFA success rate (Target: >95%, Current: 97.8%) ✓
• KPI 3: Account compromise incidents (Target: 0, Current: 0) ✓
• KPI 4: Help desk MFA tickets (Target: <30/month, Current: 23) ✓

Measurement Frequency:

• Real-time metrics: Dashboard monitoring (availability, security events)
• Weekly metrics: Vulnerability management, incident trends
• Monthly metrics: KPI reporting to security leadership
• Quarterly metrics: Control testing, management review
• Annual metrics: Full ISMS review, objective achievement

Improvement Sources

1. Internal Audits (Clause 9.2)

   • Annual internal audit schedule
   • Non-conformities tracked to closure
   • Opportunities for improvement logged

2. Management Reviews (Clause 9.3)

   • Quarterly ISMS performance review
   • Action items assigned and tracked
   • Strategic direction updates

3. Incident Lessons Learned (Control 5.27)

   • Post-incident review for all security incidents
   • Root cause analysis
   • Preventive action implementation

4. Risk Assessment Updates (Clause 6.1.2)

   • Annual comprehensive risk assessment
   • Ad-hoc assessments for significant changes
   • Emerging risk identification

5. External Assessments

   • ISO 27001 surveillance audits (annual)
   • Penetration testing (annual)
   • Vulnerability assessments (quarterly)

6. Threat Intelligence (Control 5.7)

   • New threat identification
   • Control adaptation to evolving threats

7. Stakeholder Feedback

   • Customer security questionnaires
   • Employee security survey (annual)
   • Management feedback

Improvement Register

SoA Maintenance and Versioning

Document Maintenance Process

Regular Review Cycle:

• Quarterly: Review implementation status updates
• Semi-Annually: Review risk mappings and control effectiveness
• Annually: Full SoA review and approval
• Ad-Hoc: Upon significant organizational or regulatory changes

Triggers for SoA Updates:

1. New risk identified in risk assessment
2. Control implementation status change
3. New technology or system deployment
4. Organizational restructuring
5. Regulatory requirement change
6. Audit finding or recommendation
7. Significant security incident
8. Merger, acquisition, or divestiture
9. ISMS scope change
10. ISO 27001 standard update

Change Management

SoA Change Procedure:

1. Proposed change documented with justification
2. Impact assessment (affected controls, risks, evidence)
3. Review by ISMS Coordinator
4. Approval by CISO
5. Management approval for scope or applicability changes
6. SoA document updated (version increment)
7. Affected stakeholders notified
8. Evidence updated accordingly
9. Training/communication if required
10. Audit log updated

Change Log (Last 5 Changes):

Version Control

Current Version: 1.5 Approved By: John Smith (CISO), Jane Doe (COO) Approval Date: 2024-03-15 Next Scheduled Review: 2024-06-15 Distribution:

• Executive Leadership Team
• Information Security Team
• Compliance Team
• Internal Audit
• External Auditor (upon request)

Document Storage:

• Master Copy: SharePoint/ISMS/Core Documents/SoA/
• File Name: SoA-v1.5-2024-03-15.pdf
• Previous Versions: Archived in SharePoint version history

Integration with Other ISMS Documents

The SoA is integrated with:

• Risk Register: Risks referenced in SoA, controls referenced in risk treatment
• Risk Treatment Plan: Control implementation tracked
• Asset Inventory: Assets classified and protected per SoA controls
• Policy Framework: Policies implement controls documented in SoA
• Audit Program: Audit scope based on applicable controls
• Evidence Repository: Evidence mapped to controls
• Management Review: SoA updates reported to management
• Internal Audit Plan: Audit schedule covers all applicable controls over 3-year cycle

Using This SoA Template

Implementation Guidance

Step 1: Customize the Template

• Replace [Organization Name] with your company name
• Update document control information
• Adjust ISMS scope statement

Step 2: Conduct Risk Assessment

• Identify your organization's information security risks
• Assign risk IDs and ratings
• Document in risk register

Step 3: Determine Control Applicability

• Review each of the 93 Annex A controls
• Decide applicable vs. not applicable based on:
  • Risk treatment decisions
  • Legal/regulatory requirements
  • Contractual obligations
  • Business requirements
  • Cost-benefit analysis

Step 4: Document Applicability Decisions

• For APPLICABLE controls:
  • Document how implemented
  • Link to risks mitigated
  • Provide evidence references
  • Note implementation status
• For NOT APPLICABLE controls:
  • Provide clear justification
  • Document risk assessment decision
  • Get management approval

Step 5: Map Controls to Risks and Evidence

• Complete risk-to-control mapping
• Complete control-to-evidence mapping
• Ensure traceability

Step 6: Identify Gaps

• Assess implementation status
• Document gaps and create remediation plan
• Prioritize based on risk

Step 7: Establish Maintenance Process

• Set review schedule
• Assign ownership
• Integrate with other ISMS processes

Step 8: Obtain Management Approval

• Present SoA to management
• Obtain formal approval
• Distribute to relevant stakeholders

Auditor Expectations

What Auditors Look For:

1. All 93 controls addressed (applicable or not applicable)
2. Clear justification for controls marked not applicable
3. Evidence of management approval for N/A decisions
4. Consistency between SoA, risk assessment, and risk treatment plan
5. Traceability from risks to controls to evidence
6. Implementation details sufficient to verify during audit
7. Regular review and updates
8. Version control and change management
9. Evidence readily available and organized
10. No "checkbox compliance" - genuine implementation

Common Audit Findings:

• Insufficient justification for N/A controls
• Controls marked "implemented" but lacking evidence
• SoA not updated after organizational changes
• No management approval of SoA
• Incomplete risk-to-control mapping
• Evidence references broken or documents not found
• Implementation description too vague to verify
• Controls implemented differently than documented
• No review cycle established
• SoA not integrated with risk assessment

Best Practices

1. Be Honest: Don't claim controls are implemented if they're not. "Planned" is acceptable.

2. Be Specific: Vague implementation descriptions won't pass audit. Provide details.

3. Be Consistent: Ensure SoA aligns with your risk assessment, policies, and procedures.

4. Be Traceable: Maintain clear links between risks, controls, and evidence.

5. Be Organized: Organize evidence systematically and reference it clearly.

6. Be Current: Keep SoA updated as your ISMS evolves.

7. Be Reasonable: Don't mark controls N/A just to reduce workload. Must be genuinely not applicable.

8. Engage Management: Management must understand and approve the SoA.

9. Leverage Technology: Use GRC tools to manage SoA, risks, and controls if scale justifies.

10. Learn from Others: Participate in ISO 27001 user groups and learn from peers.

Conclusion

The Statement of Applicability is your master control document for ISO 27001. It demonstrates:

• Systematic approach to security control selection
• Risk-based thinking
• Management commitment
• Due diligence and accountability

A well-maintained SoA makes certification audits smoother and provides ongoing value by:

• Creating visibility into control implementation status
• Facilitating gap analysis and improvement planning
• Supporting compliance with multiple frameworks
• Enabling efficient evidence collection
• Serving as the foundation for control testing

Invest time in creating a comprehensive, accurate, and well-maintained SoA. It will be your primary reference throughout your ISO 27001 journey.

Next Lesson: In Lesson 3.10, we'll cover Security Objectives Template - how to define measurable information security objectives using the SMART framework and create an objectives dashboard to track progress toward your ISMS goals.