Noru

Free template

ISO 27001 Statement of Applicability template

Every Annex A control of ISO/IEC 27001:2022, theme by theme, with the columns clause 6.1.3 needs: applicable or not, why, whether it is implemented, and who owns it.

Fill it in after the risk assessment, not before. Each applicable control should name the risks or obligations that need it; each excluded control needs a reason someone could check, such as having no premises or building no software.

Keep it versioned and approved by the risk owners. The certificate commonly references the SoA version the audit was based on, and surveillance audits look at how it has changed.

The guide behind it: ISO 27001 Statement of Applicability: How to Write One That Survives the Audit

[Company] Statement of Applicability

Version[1.0]
Approved by[Risk owners or ISMS owner, title]
Date[YYYY-MM-DD]
Based on risk assessment[Version and date]
ISMS scope[Reference to the scope statement]

A.5 Organizational controls

Applicable: Yes or No. Justification: the risk IDs or obligation for an inclusion, the checkable fact for an exclusion. Status: Implemented, Partly, or Planned with a date.

ControlTitleApplicableJustificationStatusOwner
A.5.1Policies for information security[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.2Information security roles and responsibilities[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.3Segregation of duties[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.4Management responsibilities[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.5Contact with authorities[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.6Contact with special interest groups[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.7Threat intelligence[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.8Information security in project management[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.9Inventory of information and other associated assets[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.10Acceptable use of information and other associated assets[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.11Return of assets[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.12Classification of information[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.13Labelling of information[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.14Information transfer[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.15Access control[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.16Identity management[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.17Authentication information[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.18Access rights[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.19Information security in supplier relationships[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.20Addressing information security within supplier agreements[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.21Managing information security in the ICT supply chain[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.22Monitoring, review and change management of supplier services[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.23Information security for use of cloud services[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.24Information security incident management planning and preparation[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.25Assessment and decision on information security events[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.26Response to information security incidents[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.27Learning from information security incidents[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.28Collection of evidence[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.29Information security during disruption[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.30ICT readiness for business continuity[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.31Legal, statutory, regulatory and contractual requirements[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.32Intellectual property rights[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.33Protection of records[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.34Privacy and protection of PII[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.35Independent review of information security[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.36Compliance with policies, rules and standards for information security[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.5.37Documented operating procedures[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]

A.6 People controls

ControlTitleApplicableJustificationStatusOwner
A.6.1Screening[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.6.2Terms and conditions of employment[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.6.3Information security awareness, education and training[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.6.4Disciplinary process[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.6.5Responsibilities after termination or change of employment[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.6.6Confidentiality or non-disclosure agreements[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.6.7Remote working[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.6.8Information security event reporting[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]

A.7 Physical controls

ControlTitleApplicableJustificationStatusOwner
A.7.1Physical security perimeters[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.7.2Physical entry[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.7.3Securing offices, rooms and facilities[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.7.4Physical security monitoring[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.7.5Protecting against physical and environmental threats[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.7.6Working in secure areas[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.7.7Clear desk and clear screen[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.7.8Equipment siting and protection[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.7.9Security of assets off-premises[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.7.10Storage media[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.7.11Supporting utilities[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.7.12Cabling security[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.7.13Equipment maintenance[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.7.14Secure disposal or re-use of equipment[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]

A.8 Technological controls

ControlTitleApplicableJustificationStatusOwner
A.8.1User endpoint devices[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.2Privileged access rights[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.3Information access restriction[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.4Access to source code[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.5Secure authentication[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.6Capacity management[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.7Protection against malware[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.8Management of technical vulnerabilities[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.9Configuration management[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.10Information deletion[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.11Data masking[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.12Data leakage prevention[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.13Information backup[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.14Redundancy of information processing facilities[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.15Logging[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.16Monitoring activities[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.17Clock synchronization[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.18Use of privileged utility programs[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.19Installation of software on operational systems[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.20Networks security[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.21Security of network services[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.22Segregation of networks[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.23Web filtering[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.24Use of cryptography[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.25Secure development life cycle[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.26Application security requirements[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.27Secure system architecture and engineering principles[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.28Secure coding[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.29Security testing in development and acceptance[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.30Outsourced development[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.31Separation of development, test and production environments[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.32Change management[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.33Test information[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]
A.8.34Protection of information systems during audit testing[Yes/No][Risk IDs or obligation / reason for exclusion][Status][Role]

Controls from outside Annex A

Clause 6.1.3 asks for every necessary control, not only Annex A's: customer contract terms, sector rules and your own treatments belong here.

ControlTitleApplicableJustificationStatusOwner
[ID][Control]Yes[Risk IDs or obligation][Status][Role]

All templates

FAQ

Frequently asked questions

Talk to us

Why does the template list all 93 controls?

Because clause 6.1.3 asks you to compare your controls with Annex A so nothing necessary is missed, and the auditor reads the SoA to see a decision for every one. Excluded controls stay in the table with their reason.

Can we keep the SoA in a spreadsheet?

Yes. The standard sets no format. What matters is that it is versioned, approved, and agrees with the risk treatment plan and the controls you actually run, so whichever format you use, keep it under document control.

Trust, settled.

Templates are the start. Noru drafts the policies from your own setup, tracks approvals and acknowledgements, and keeps the evidence.

Book a demoMore templates