Statement of Applicability (SoA) in ISO 27001 Certification

What is a Statement of Applicability (SoA)?

The Statement of Applicability (SoA) is a document that defines which security controls from Annex A of ISO 27001 apply to your Information Security Management System (ISMS).

The SoA connects three key elements: your risk assessment, the security controls you've selected, and evidence that no relevant controls have been overlooked. This makes it one of the first documents auditors typically request – and one that customers may also want to review as part of their security questionnaires.

Mandatory SoA Requirements Under ISO 27001:2022

Clause 6.1.3 d) requires four specific pieces of information. Two additional fields are not mandatory under the standard but can make the audit process significantly easier.

Overview of the 93 Controls in Annex A

ISO 27001:2022 streamlined the previous 114 controls across 14 domains into 93 controls organized into four themes.

These 11 Controls Were Introduced in 2022

1. 5.7 Threat Intelligence
2. 5.23 Information Security for Use of Cloud Services
3. 5.30 ICT Readiness for Business Continuity
4. 7.4 Physical Security Monitoring
5. 8.9 Configuration Management
6. 8.10 Information Deletion
7. 8.11 Data Masking
8. 8.12 Data Leakage Prevention (DLP)
9. 8.16 Monitoring Activities
10. 8.23 Web Filtering
11. 8.28 Secure Coding

These are precisely the controls that are often missing from SoAs copied from outdated ISO 27001:2013 templates.

How to Create an SoA in 6 Steps

1. Define the scope. Identify the locations, systems, processes, and service providers covered by your ISMS. These determine which controls may be relevant in the first place.
2. Assess your risks. Identify assets, threats, and vulnerabilities, then evaluate each risk based on its likelihood and potential impact.
3. Plan risk treatment. Define appropriate measures for every risk that cannot be accepted, regardless of where those measures originate.
4. Cross-check against Annex A. Review all 93 controls to ensure no necessary controls have been overlooked. Justify each decision based on risks, legal requirements, or contractual obligations.
5. Document implementation status and evidence. Record the implementation status, responsible owners, and supporting evidence for each control.
6. Approve and maintain version control. Have senior management approve the SoA and review it whenever the scope changes, following security incidents, and at least once a year.

Example: What a Completed SoA Looks Like

Fictional example: a SaaS company with 40 employees, operating entirely in the cloud, with no dedicated data center.

Common Mistakes in the SoA

The SoA in the Certification Audit

During Stage 1, the certification body checks whether the SoA is complete and aligned with the risk assessment. In Stage 2, auditors conduct sample checks to verify whether controls marked as "implemented" are actually effective in practice. After certification, the SoA remains a key reference document for annual surveillance audits.

Automating and Managing Your SoA with heyData

At heyData, we support companies throughout their entire journey to ISO 27001 certification – and the Statement of Applicability (SoA) plays a central role in that process. We don't just provide a tool to document your SoA. We actively help you build it correctly and continuously adapt it as your ISMS evolves.

Our approach ensures that your SoA doesn't remain a static document but becomes a dynamic reflection of your information security strategy.

With heyData, you can:

• Link Annex A controls to your risk assessment and security policies.
• Generate your SoA based on your asset and risk registers, with clear traceability and supporting evidence for every control.
• Track implementation progress and assign responsibilities transparently.
• Stay audit-ready with version control and change tracking for every SoA update.
• Drive continuous improvement by incorporating findings from audits and management reviews directly into your SoA.

In short: heyData transforms your SoA from a compliance requirement into a living management tool that brings governance, risk, and security together in one central system.