# What is a statement of applicability in ISO 27001?

It is the document that lists every reference control from the standard’s annex and says, for each one, whether you apply it, why, and how it is implemented. The statement of applicability (SoA) connects your risk assessment to your controls: a control is included because it treats an identified risk or meets a legal or contractual obligation, and excluded only with a stated reason, for example because you have no physical premises of your own. Auditors use it as a map of your ISMS and test the controls it claims; customers sometimes ask for it to understand what your certificate actually covers. Keep it short and factual, name the evidence for each implemented control, and update it when your risks or set-up change. A good SoA entry for monitoring names the tool, the systems it covers, who reviews its output and where the records are kept. If NetSenX is part of your monitoring, its network map, alert history and audit log can be referenced as evidence; the SoA itself is your document.

FAQ: [Security standards: ISO 27001, SOC 2](https://netsenx.com/en/faq/standards) · https://netsenx.com/en/faq/what-is-a-statement-of-applicability

## Read next

- https://netsenx.com/en/compliance
- https://netsenx.com/en/security
- https://netsenx.com/en/nis2-readiness

## Related questions

- [What is SOC 2, and why do customers ask for it?](https://netsenx.com/en/faq/what-is-soc-2)
- [What is the difference between a SOC 2 Type 1 and a Type 2 report?](https://netsenx.com/en/faq/soc-2-type-1-vs-type-2)
- [Do we need ISO 27001 or SOC 2?](https://netsenx.com/en/faq/iso-27001-or-soc-2-which-do-we-need)
- [What is ISO/IEC 42001?](https://netsenx.com/en/faq/what-is-iso-42001)
- [What is IEC 62443, and do we need it?](https://netsenx.com/en/faq/what-is-iec-62443)