Statement of Applicability (SoA)
Export all 93 ISO 27001:2022 Annex A controls with applicability, justification and implementation status, through the app or MCP.
Does Noru have a native SoA?
Yes. Noru generates a Statement of Applicability CSV with one row for each of the 93 ISO 27001:2022 Annex A controls. It uses your current control records and framework mappings. It is an export, not a separate editable SoA register. The same statement is included in the external audit package.
Export from the app
Enable ISO 27001 in Settings → Frameworks first. Its associated ISO 27002 controls are enabled together with it.
The statement includes all 93 Annex A controls regardless of the list filters or framework checkboxes used for the separate controls spreadsheet export. The filename includes the export date.
| Column | Contents |
|---|---|
| ID | Annex A reference, such as A.5.1 |
| Control Name | Annex A control name |
| Applicability | Applicable or Not Applicable |
| Implementation Status | Aggregated implementation status, Excluded, or Review required |
| Implementation Details / Justification | Inclusion or exclusion rationale, implementation details and relevant linked references |
How the statement is generated
Noru includes both ISO 27001 and ISO 27002 mappings to Annex A. Recorded justifications retain their full text, including multiple sentences. Several Noru controls can contribute to one Annex A row.
- An Annex A control is Not Applicable only when every mapped Noru control has a recorded Not applicable status. Its exclusion justification comes from those status reasons; missing reasons receive a default rationale.
- Otherwise the row is Applicable. Inclusion rationale starts with the built-in rationale for that Annex A control. Details draw on your control status reasons, implementation notes and linked evidence, policies and risks.
- Implementation status reflects the least complete applicable mapped control. Missing or indeterminate statuses produce Review required. Missing mappings also produce Review required, rather than excluding the row.
Review the generated rationale against your organization's actual scope and risk decisions. A default rationale is not a substitute for your own decision. Update the underlying control records and export again when the statement needs correction.
Read or export through MCP or REST
Ask your agent to call getStatementOfApplicability. It takes no arguments
and uses the authenticated organization. It returns all 93 structured rows
alongside the same CSV and filename generated by the app.
REST clients can call GET /v1/controls/statement-of-applicability for the
same structured rows and CSV.
The connection needs read:controls, read:frameworks, read:evidence,
read:policies and read:risks: the statement includes linked records from
these areas. If access is missing, reconnect with the required permissions.
ISO 27001 must be enabled for the organization.
For example: “Get our ISO 27001 Statement of Applicability and highlight rows that need review or have incomplete justification.” Reading the statement does not change control statuses, approve it, or save evidence.
Policies or evidence on RM-10?
Maintain the live inputs in your control records. You do not need to copy the 93-row list into a policy to generate the statement.
For a retained review or audit snapshot, export the statement, review it through your organization's approval process, and upload the retained file as evidence linked to RM-10 — Statement of Applicability. Its evidence request is E-RM-17 — Statement of Applicability (SOA). Retain the approval record alongside the statement; exporting alone does not record management approval.
A policy can describe who maintains and reviews the SoA and when it is updated. That governance document serves a different purpose from the actual 93-row statement. Later exports reflect current records; they do not replace a previously retained snapshot automatically.
Last updated on