Statement of Applicability
Explains which controls are applicable, why, and their implementation position.
Free Website Tool
ISO 27001 Statement of Applicability Builder
Build and review a clear Statement of Applicability across all 93 Annex A controls. Record each decision, its justification, implementation status and evidence.
Tool summary
- Framework
- Annex A · 93 controls
- Purpose
- Statement of Applicability
- Privacy
- Browser only
- Persistence
- Local autosave
Related records
Risk Register
Records identified risks and their assessment.
Risk Treatment Plan
Records actions selected to address risks.
Local working document
Build a practical SoA
Choose a control, record the applicability decision and justification, then add implementation status and evidence.
Your SoA is stored in this browser and is not uploaded to AuditPrepared.
SoA summary
- Controls
- 93
- Reviewed
- 0
- Applicable
- 0
- Implemented
- 0
- Needs attention
- 0
Annex A controls
Showing 93 controls
| Control | Title | Applicability | Implementation | Review |
|---|
Quality review
Useful checks
Concise prompts for incomplete decisions; not a compliance score.
Worked example
See how one SoA row connects decision, status and evidence
| Field | Illustrative entry for Annex A 5.15 Access control |
|---|---|
| Applicability | Applicable |
| Justification | Customer data and production services are accessed by workforce and supplier identities; risk treatment requires controlled authorisation and review. |
| Implementation status | Partially implemented |
| Evidence reference | Access policy ISMS-POL-04; identity approval workflow; Q3 privileged-access review; two overdue supplier-account actions. |
| Owner and next action | Identity owner — close overdue supplier actions and verify removal before the next review. |
This example shows the difference between applicability, current status and evidence. Do not copy it without assessing your own scope, risks and treatment decisions.
Practical guidance
Build an SoA that supports real decisions
A Statement of Applicability records which information-security controls are necessary, why they are included or excluded, and their implementation position. It connects risk treatment to the controls your organization operates.
What should an SoA contain?
A useful minimum is the control identifier and title, applicability decision, justification, implementation status and evidence reference. Optional ownership and notes can support maintenance without turning the record into a full GRC workflow.
What makes a good justification?
Use specific organizational context. Explain the risk, obligation, service, technology or scope decision behind inclusion or exclusion. Avoid generic wording such as “required by ISO”.
How an auditor may review it
- Confirm all 93 controls were considered.
- Review applicability decisions and sample justifications.
- Compare implementation status with current evidence.
- Trace relevant controls to risk treatment and operational practice.