ISO 27001 Statement of Applicability Template

Description

ISO 27001 Statement of Applicability

The Single Most Important Document for Your ISO 27001 Audit

The Statement of Applicability (SoA) is a fundamental and mandatory document for your ISO 27001 implementation and certification. It serves as the master list of all possible security controls from the standard, and for each control, it documents whether it applies to your organization and the justification for that decision. This template is fully updated to include the new controls introduced in the ISO 27001:2022 version.

This definitive Statement of Applicability template (in .xls format) meets the requirements of ISO 27001 Clause 6.1.3 and supports both the ISO/IEC 27001:2022 and ISO/IEC 27001:2013 standards.

What is the ISO 27001 Statement of Applicability?

The ISO 27001 Statement of Applicability is the official, documented list of the information security controls your business has chosen to implement. Crucially, it also lists any controls from the standard that you have deemed not applicable and provides the justification for their exclusion. It is a cornerstone document of your Information Security Management System (ISMS) and is required for certification. You will not be able to certify to ISO 27001 without it, and it may also be requested by your clients and customers.

Our Statement of Applicability Template is a pre-populated Microsoft Excel spreadsheet, created to fully meet the requirements of ISO 27001. It is designed to save you significant time and fast-track your implementation. Its purpose is to clearly communicate your implemented security controls to employees, clients, auditors, and other interested parties.

Key Benefits:

• Save time: The template is already populated with all the up-to-date, required controls from Annex A and is ready to use.
• Meet standard requirements: The template is directly mapped to the requirements of ISO 27001:2022 Clause 6.1.3.
• Save money: Avoid paying expensive consultants to research and create this complex document for you.

Frequently Asked Questions (FAQ)

• Who is this template for? It’s for any organization or individual that wants to save time and money by using a pre-populated SoA that fully meets the ISO 27001 standard and contains all the updated controls.
• What format is the template in? The template is a fully editable Microsoft Excel file.
• How complete is it? It is 100% complete with all Annex A controls from the 2022 standard. You simply need to review each control and update the columns to reflect your organization’s decisions.
• How long will it take to implement? We estimate it will take an average of 15 minutes to configure for your business.
• Do I need to hire a consultant to use this? No. The template is designed to be easy to implement and configure and comes with step-by-step guidance.
• Is this the only template I need for certification? No. The SoA is a single, mandatory document. For full ISO 27001 certification, you will require a complete Information Security Management System (ISMS), which is available in our Ultimate ISO 27001 Toolkit. We offer this template as a standalone product because many people only require the SoA.