thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Statement of Applicability (SoA)

ISO/IEC 27001 document listing all Annex A controls, whether each is included or excluded, and justification.

Definition

The SoA records necessary controls, justification for inclusion, whether they are implemented, and justification for any exclusions. It links risk treatment to the control set and is a mandatory document reviewed during certification audits.

Example

The SoA excludes control 7.13 for equipment maintenance at a fully cloud-based startup with justification.

Exam tip

Every Annex A control must appear in the SoA, even if excluded.

Related terms