ISO 27001 Statement of Applicability Template
Document the applicability, justification and implementation of all 93 ISO/IEC 27001:2022 Annex A controls in one practical Excel workbook.
Download the free SoA template
Editable XLSX file · No registration required
What the template includes
All 93 Annex A controls
The complete control set, grouped into organizational, people, physical and technological controls.
Decision and justification fields
Record whether each control is applicable and explain the reason for inclusion or exclusion.
Implementation tracking
Assign owners, document implementation, link evidence and risks, and track actions and review dates.
What is a Statement of Applicability?
A Statement of Applicability, commonly called an SoA, connects an organization’s information security risks and treatment decisions with the controls in Annex A. It records which controls are applicable, why they are included or excluded, and how applicable controls are implemented.
A useful SoA is not simply a checklist. It should be specific enough to explain management decisions and point reviewers or auditors toward the relevant policies, procedures, technical settings and other evidence.
Need help assessing the Annex A controls?
Use the practical implementation library to understand each control, see implementation examples and make better-informed applicability decisions.
How to use the template
Define the scope
Confirm which locations, processes, people, systems and information are covered by the ISMS.
Review each control
Assess every Annex A control against your risks, legal duties, contractual commitments and operating context.
Justify the decision
Give a clear, organization-specific reason for inclusion or exclusion. Avoid generic statements.
Describe implementation
State how applicable controls operate and reference owners, risks, policies, procedures and evidence.
Close gaps
Use the status, action and target-date fields to manage controls that are not yet fully implemented.
Approve and maintain
Review the SoA after material changes and as part of the regular ISMS review cycle.
What a good justification looks like
Relevant
It connects the control to identified risks, obligations or business requirements.
Specific
It reflects the organization’s real scope and circumstances instead of repeating the control title.
Traceable
It links to risk IDs, policies, procedures, records or other evidence where appropriate.
Common mistakes to avoid
- Marking controls as not applicable without a defensible reason.
- Treating the Annex A list as the entire risk assessment.
- Describing planned measures as already implemented.
- Failing to link controls to owners, risks and evidence.
- Leaving the SoA unchanged after major changes to the organization or ISMS.
Build your Statement of Applicability
Download the editable workbook and tailor it to your organization, scope and risk treatment decisions.
Continue with the Annex A implementation library or read the practical SoA guide.
This independent template is intended as practical guidance and is not an official ISO publication. Adapt it to your organization and obtain appropriate professional advice where required.