ISO/IEC 27001:2022 · Statement of Applicability
SoA Generator
Single-file SoA builder, client-side only. Your data stays in your browser (localStorage) and never leaves your machine unless you export it.
How it works
Three steps to your SoA
- Answer each control. Work through the 93 Annex A controls one at a time, marking each Applicable (Y) or Not applicable (N).
- Justify everything. Excluded controls need a justification; included ones need reasons and a short rationale. Your progress saves automatically.
- Export. Download the finished Statement of Applicability as XLSX or JSON when every control is answered.
What is an SoA?
A statement, not a checklist
A Statement of Applicability is a documented statement of which controls are relevant to your ISMS and, just as importantly, why. It records the justification for every Annex A control you include, and the justification for every one you leave out.
It is more than a tick-box exercise: the external auditor reads it first during certification, and your management must approve it before the ISMS goes live. No other management-system standard, not ISO 9001, not ISO 14001, asks for an equivalent document. It is unique to ISO/IEC 27001.
Scope sanity check: you are free to draw controls from any source, or write your own, but you must show your working for Annex A. Every one of the 93 controls has to be considered and accounted for, in or out. This wizard makes sure none slip through.
Good to know
Write an SoA an auditor respects
- Risk first. Control choices should flow from your risk assessment and treatment plan. Drafting the SoA before those exist puts the cart before the horse.
- Six columns per control. A solid SoA row names the control, states applicability, describes how it is implemented, justifies the decision, points at the documented proof, and names the responsible owner. This wizard collects all six.
- Right-size it. Most organisations land above 80 controls. Too many wastes money with no benefit; too few leaves risks untreated. Justify each one on its merits.
- Exclusions need teeth. “Not applicable” is a claim, so back it: no such activity exists here, the law forbids it, or the risk sits elsewhere. Vague exclusions get challenged.
Actions
Your answers save automatically in this browser. Export when every control is answered.
A.5.1
Control title
| ID | Control Title | Description |
|---|---|---|
| A.5.1 | Policies for information security | Information security policy and topic-specific policies should be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur. |
| A.5.7 | Threat intelligence | Information relating to information security threats should be collected and analysed to produce threat intelligence. |
| A.8.1 | User endpoint devices | Information stored on, processed by or accessible via user endpoint devices should be protected. |
| A.8.16 | Monitoring activities | Networks, systems and applications should be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents. |