What is a statement of applicability in ISO 27001?

It is the document that lists every reference control from the standard’s annex and says, for each one, whether you apply it, why, and how it is implemented. The statement of applicability (SoA) connects your risk assessment to your controls: a control is included because it treats an identified risk or meets a legal or contractual obligation, and excluded only with a stated reason, for example because you have no physical premises of your own. Auditors use it as a map of your ISMS and test the controls it claims; customers sometimes ask for it to understand what your certificate actually covers. Keep it short and factual, name the evidence for each implemented control, and update it when your risks or set-up change. A good SoA entry for monitoring names the tool, the systems it covers, who reviews its output and where the records are kept. If NetSenX is part of your monitoring, its network map, alert history and audit log can be referenced as evidence; the SoA itself is your document.

← All 15 questions on Security standards: ISO 27001, SOC 2All topics