# Statement of Applicability (SoA) Starter
*Published by Compliance Enablers LLP | complianceenablers.com*
*Last Updated: October 2026*

---

## Introduction

The Statement of Applicability (SoA) records how your ISO/IEC 27001 programme treats the controls in your licensed copy of the standard. ISO/IEC 27001:2022 clause 6.1.3 requires a Statement of Applicability containing the necessary controls, justifications for inclusions and exclusions, and whether each control is implemented. This template adds a reference to the evidence that demonstrates it.

This starter is a blank template. It does not reproduce Annex A or any standard text — populate the control references and titles from your own licensed copy of ISO/IEC 27001. Confirm the current requirements with your certification body and your licensed copy.

This document contains no client, audit or engagement data.

---

## How to Use the Columns

For each control, complete:

- **Control reference** — the reference from your licensed copy.
- **Control title** — the title from your licensed copy.
- **Applicable (Yes / No)** — whether the control applies to your scope. If "No", the justification must explain why (for example, no software development takes place in scope).
- **Justification** — the reason for inclusion (usually a risk it treats or an obligation it meets) or exclusion. Tie each justification to a specific risk or requirement.
- **Status** — one of: Not Started, In Progress, Implemented, Not Applicable.
- **Evidence reference** — a pointer to the policy, procedure, configuration, ticket or record that demonstrates the control operates.

A legend you can reuse: **NS** Not Started · **IP** In Progress · **IM** Implemented · **NA** Not Applicable.

---

## SoA Template

Add one row per control from your licensed copy. The themes below follow the four themes of ISO/IEC 27001:2022 Annex A — confirm their names and contents in your copy.

### Organisational theme

| Control ref | Control title | Applicable | Justification | Status | Evidence ref |
| --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |
|  |  |  |  |  |  |
|  |  |  |  |  |  |

Organisational controls commonly cover policies, roles and responsibilities, supplier relationships, incident management, continuity and legal and regulatory requirements.

### People theme

| Control ref | Control title | Applicable | Justification | Status | Evidence ref |
| --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |
|  |  |  |  |  |  |
|  |  |  |  |  |  |

People controls commonly cover screening, terms of employment, awareness, discipline and remote working.

### Physical theme

| Control ref | Control title | Applicable | Justification | Status | Evidence ref |
| --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |
|  |  |  |  |  |  |
|  |  |  |  |  |  |

Physical controls commonly cover perimeters, equipment and media. Exclusions are common for fully cloud-hosted, office-light organisations — justify them against your scope.

### Technological theme

| Control ref | Control title | Applicable | Justification | Status | Evidence ref |
| --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |
|  |  |  |  |  |  |
|  |  |  |  |  |  |

Technological controls commonly cover endpoint protection, access, cryptography, secure development, logging and network security.

---

## Common SoA Mistakes to Avoid

- **Copy-pasted justifications.** Each justification should tie to a specific risk or requirement, not a generic sentence repeated for every control.
- **Stale evidence references.** If the SoA points at a policy that no longer exists or a ticket that was closed without an artefact, the control fails on sampling.
- **Unexplained exclusions.** Excluding a control is fine only with a justification grounded in your scope.
- **SoA drift from the risk treatment plan.** The SoA and the risk treatment plan should agree. Reconcile them before every surveillance audit.
- **Treating the SoA as a one-time document.** It is a living record. Update status and evidence as controls are implemented and as scope changes.

---

## How the Platform Supports Your SoA

Compliance Enablers runs ISO 27001 as one of 30 standards as guided programmes — scoping, assessment, scoring, evidence and readiness — with every dashboard module included in every plan. Controls, evidence and findings map across standards through thousands of curated crosswalk mappings, so evidence collected once counts everywhere it applies.

ISO 27001 is a licensed standard: it opens only after you confirm in-app that you hold your own licensed copy, and the platform works alongside your copy without selling or redistributing standard text. AI runs on Anthropic Claude for generation and OpenAI for embeddings; no customer data is used to train models, and every AI action is metered and visible to the customer.

---

*This resource is a blank template, not legal or certification advice. Confirm the current standard text and audit requirements with your certification body and your licensed copy.*