What is an ISO 27001 Statement of Applicability?

The Statement of Applicability (SoA) is a mandatory ISO 27001 document that lists all Annex A controls, states whether each is applicable or excluded, and provides a justification for every decision. It links your risk treatment plan to your actual security controls.

Which ISO 27001 controls can an SMB exclude from the SoA?

You can exclude any Annex A control that is not relevant to your organization, provided you document a clear justification and the exclusion does not affect your ability to meet your information security objectives or residual risk targets.

How detailed do justifications need to be in the SoA?

Auditors expect justifications to reference your risk assessment outcomes, legal or contractual requirements, or business context. A one-line reason is rarely sufficient. Each justification should explain why the control is included or excluded in plain, traceable language.

Does the SoA need to reference specific policies or procedures?

Yes. Best practice and auditor expectation is that each applicable control maps to the policy, procedure, or technical measure that implements it. This cross-referencing demonstrates that controls are not just selected on paper but are operationally active.

How often should an SMB update its Statement of Applicability?

The SoA should be reviewed at least annually and whenever a significant change occurs, such as a new product launch, a change in cloud infrastructure, a new regulatory requirement, or the results of an updated risk assessment.

Can compliance software help SMBs build their SoA faster?

Yes. AI-powered compliance platforms like ComplyGuard can pre-map Annex A controls to your risk profile, generate draft justifications, and maintain version history so your SoA stays audit-ready without requiring a full-time consultant.

ISO 27001 Statement of Applicability Guide for SMBs

The ISO 27001 Statement of Applicability is one of the most misunderstood — and most critical — documents in your entire certification journey. For small and mid-sized businesses navigating ISO 27001 for the first time, getting the SoA right can mean the difference between a smooth audit and a costly, time-consuming remediation cycle. This guide breaks down exactly what the SoA is, how to build one that satisfies auditors, and how to avoid the mistakes that trip up most SMBs.

What Is the ISO 27001 Statement of Applicability?

The Statement of Applicability (SoA) is a mandatory document required by ISO/IEC 27001 — specifically referenced in clause 6.1.3(d). It serves as the formal record of which controls from Annex A your organization has selected, which it has excluded, and — critically — the business justification for every single decision.

Think of the SoA as the bridge between your risk assessment and your actual security implementation. It answers three fundamental questions for your auditor:

Which controls apply to your organization?
Which controls have been implemented?
Why have certain controls been excluded?

Under the 2022 revision of the standard (ISO/IEC 27001:2022), Annex A was restructured from 114 controls across 14 domains into 93 controls organized across 4 themes: Organizational, People, Physical, and Technological. If you're working from an older template built around the 2013 version, it's time to update your approach.

SoA vs. Risk Treatment Plan: Understanding the Difference

Many SMBs conflate the SoA with the Risk Treatment Plan (RTP). They are related but distinct. The RTP documents how you plan to treat identified risks — through mitigation, acceptance, transfer, or avoidance. The SoA documents the controls you've selected (largely informed by the RTP) and provides the formal justification for each inclusion or exclusion. Your auditor will cross-reference both documents, so inconsistencies between them are a red flag.

Why the ISO 27001 Statement of Applicability Matters More Than You Think

Auditors treat the SoA as a lens through which they evaluate your entire Information Security Management System (ISMS). A vague or incomplete SoA signals that your risk assessment process was superficial. A well-constructed SoA, on the other hand, demonstrates organizational maturity and gives your auditor confidence that you understand your own threat landscape.

For SMBs specifically, the SoA also serves a practical internal purpose: it forces leadership to make deliberate, documented decisions about security investments. Rather than implementing controls reactively or copying a competitor's checklist, you're building a security program that reflects your actual business context.

Legal and Contractual Implications

Beyond certification, your SoA may be requested by enterprise customers, partners, or procurement teams as part of vendor due diligence. A polished, well-reasoned SoA can accelerate sales cycles and build trust with prospects who need assurance that your security posture is intentional — not accidental.

How to Build Your ISO 27001 Statement of Applicability: Step-by-Step

Building a defensible SoA is a structured process. Here's how to approach it without getting overwhelmed.

Step 1: Complete Your Risk Assessment First

The SoA cannot be built in isolation. You must first conduct a thorough information security risk assessment that identifies your assets, threats, vulnerabilities, and risk owners. Your control selections in the SoA must be traceable back to specific risks identified in this assessment. Auditors will ask for this traceability — if you can't show it, you'll face a nonconformity.

Step 2: Review All 93 Annex A Controls

Work through every control in Annex A systematically. For each control, your team needs to determine:

Is this control relevant to our organization's context and risk profile?
Have we already implemented it, partially implemented it, or not yet started?
If we're excluding it, what is the documented justification?

Common legitimate exclusions for SMBs include controls related to physical security at data centers (if you're fully cloud-hosted) or supplier relationship controls that don't apply to your vendor model. However, exclusions must be airtight — "we don't think it's necessary" is not an acceptable justification.

Step 3: Document Justifications for Every Decision

This is where most SMBs cut corners and pay for it later. Every included control needs a justification tied to a specific risk or legal/contractual requirement. Every excluded control needs a clear rationale explaining why the risk it addresses either doesn't exist in your environment or is addressed through an alternative control.

Strong justification language sounds like: "Control 8.8 (Management of technical vulnerabilities) is included because our risk assessment identified unpatched software as a high-likelihood threat vector given our SaaS product architecture and external-facing APIs."

Step 4: Map Implementation Status Honestly

Your SoA should reflect reality, not aspiration. Use a clear status taxonomy such as:

Fully Implemented — Control is operational and evidenced
Partially Implemented — Control is in progress with a defined completion date
Planned — Control is scheduled but not yet started
Not Applicable — Control is excluded with documented justification

Auditors don't expect perfection at Stage 1 — they expect honesty and a credible plan. Misrepresenting implementation status is far more damaging than acknowledging gaps.

Step 5: Assign Ownership and Review Dates

Each control in your SoA should have a named owner — a specific person or role responsible for implementation and ongoing maintenance. The SoA is also a living document; it must be reviewed and updated whenever your risk landscape changes, new systems are introduced, or the standard itself is revised. Build a review cadence into your ISMS calendar — at minimum annually, and after any significant organizational change.

Common SoA Mistakes SMBs Make (and How to Avoid Them)

Having worked with dozens of SMBs through their ISO 27001 journey, certain patterns of failure appear repeatedly. Here are the most consequential ones:

Copying a template without customization: Generic SoA templates are a starting point, not a finish line. An auditor can spot a copy-paste job immediately, and it undermines your entire ISMS narrative.
Excluding controls without justification: Blanket exclusions like "not applicable to our business" without supporting rationale are a guaranteed nonconformity finding.
Disconnecting the SoA from the risk assessment: If your risk assessment identifies a threat but your SoA excludes the corresponding control without explanation, you have a logical gap that auditors will probe.
Treating the SoA as a one-time document: Organizations that build the SoA for certification and then file it away typically fail their surveillance audits. It must evolve with your business.
Using the 2013 control set in 2024: If you haven't transitioned to the ISO 27001:2022 Annex A structure, you're working with an outdated framework. The transition deadline for existing certifications was October 2025.

SoA Structure: What to Include in Each Row

While there's no single mandated format, a well-structured SoA table typically includes the following columns for each control:

Column	Description
Control Reference	Annex A control number (e.g., 5.1, 8.8)
Control Name	Official control title from the standard
Included / Excluded	Binary applicability decision
Justification	Risk-based or legal/contractual rationale
Implementation Status	Fully implemented, partial, planned, N/A
Control Owner	Named individual or role
Evidence Reference	Link to policy, procedure, or system record
Review Date	Next scheduled review

Adding an evidence reference column is particularly valuable — it creates a direct audit trail from your SoA to your actual documentation and system configurations, dramatically reducing the time spent during evidence collection.

How Technology Can Accelerate Your SoA Process

Building and maintaining a comprehensive SoA manually — especially while running a business — is genuinely difficult. Spreadsheets break down quickly when you're tracking 93 controls, multiple owners, evidence links, and review dates simultaneously. This is where purpose-built compliance automation platforms change the equation entirely.

ComplyGuard was built specifically to solve this problem for SMBs. Our platform provides pre-mapped control libraries aligned to ISO 27001:2022, automated evidence collection, and a dynamic SoA builder that stays synchronized with your risk register in real time. Instead of spending weeks building a spreadsheet that goes stale the moment you close it, you get a living SoA that reflects your actual implementation status at any given moment. Explore how ComplyGuard's ISO 27001 automation features work to understand the full scope of what's possible.

For SMBs comparing compliance tools, it's worth understanding how different platforms handle the SoA specifically — not all tools treat it as a first-class document. See how ComplyGuard compares to other compliance platforms on this and other critical capabilities.

The ISO 27001 official resource page provides authoritative guidance on the standard's requirements, and the NIST Cybersecurity Framework offers complementary control guidance that many SMBs find useful when building their initial risk assessment — which feeds directly into SoA decisions.

What to Expect During an Audit of Your SoA

During Stage 1 of your ISO 27001 certification audit, your auditor will review the SoA in detail. They'll look for logical consistency between your scope, risk assessment, and control selections. They'll probe exclusions with pointed questions. During Stage 2, they'll test whether your implemented controls actually work as described. In surveillance audits, they'll check whether the SoA has been maintained and updated appropriately.

The best preparation is a SoA that you can walk through confidently — one where every decision has a clear owner who understands the rationale behind it.

Conclusion

The ISO 27001 Statement of Applicability is not a bureaucratic checkbox — it's the strategic core of your ISMS and a direct reflection of how seriously your organization takes information security. For SMBs, getting it right the first time saves significant time, money, and audit stress. That means grounding every control decision in your risk assessment, documenting justifications with specificity, assigning clear ownership, and treating the SoA as the living document it's designed to be. The organizations that treat the SoA as a genuine management tool — rather than a compliance artifact — are the ones that build security programs that actually protect their business.

If you're ready to stop wrestling with spreadsheets and start building a certification-ready SoA with confidence, ComplyGuard can get you there faster than you think. View our pricing plans to find the right fit for your team, or talk to a compliance specialist who can walk you through exactly how our platform handles ISO 27001 from risk assessment through certification — and every surveillance audit beyond.

ISO 27001 Statement of Applicability: A Complete SMB Guide