Understanding the Significance of Statement of Applicability

The Statement of Applicability is one of the most important governance documents the ISO produces within the ISMS, and one of the most frequently misunderstood. In organisations pursuing ISO 27001 certification for example, the SoA is a mandatory deliverable. In all organisations with a mature security governance framework, regardless of their certification status, it should be treated as an essential governance instrument that makes the connection between the organisation’s risk assessment, its selected controls, and its compliance obligations explicit, documented, and auditable. The ISO who treats the SoA as a certification artefact to be produced and filed has missed its governance value. The ISO who treats it as a living governance document that reflects the organisation’s current security posture and informs its ongoing improvement programme has understood what it is for.

The SoA is the formal record of the organisation’s control decisions. It documents which controls from the applicable reference set have been selected for implementation, the justification for each selection, the current implementation status of each selected control, and the justification for any controls that have been deliberately excluded. These exclusion justifications are among the SoA’s most important governance contributions, because they force the ISO to make explicit and accountable decisions about where the organisation is choosing not to implement controls that a recognised framework considers applicable, and to document the risk rationale that justifies that decision in terms that can withstand regulatory and audit scrutiny.

Understanding the SoA’s Governance Purpose #

Before the ISO can develop a SoA that serves its full governance purpose, they must understand precisely what the document is required to achieve and for whom it is most valuable. The SoA serves four distinct governance audiences whose requirements the document must simultaneously address.