Statement of applicability (SoA)

What is meant by Statement of applicability (SoA)?

The term "Statement of Applicability (SoA)" refers to a key document within an Information Security Management System (ISMS) based on ISO 27001. The SoA identifies relevant controls from ISO 27001 and explains whether they are applicable in the specific context of the organization. It justifies why certain controls were selected or excluded and describes how they are implemented. The SoA serves as a foundation for audits and ongoing reviews of the ISMS's effectiveness.

Typical software functions in the area of "Statement of Applicability (SoA)":

1. Creation and Management: Assisting in the creation, updating, and management of the SoA according to the specific needs of the organization.
2. Control Selection: Identification and selection of relevant security controls from ISO 27001 and their alignment with organizational processes.
3. Justification Documentation: Capturing and documenting the reasons for the selection or exclusion of specific controls.
4. Linkage with Risk Assessment: Integrating the SoA with the risk management process to ensure that selected controls align with identified risks.
5. Audit Preparation: Providing tools for preparing internal and external audits, including tracking changes and maintaining audit evidence.
6. Reporting: Generating reports that provide an overview of implemented and excluded controls and the reasoning behind them.
7. Versioning and History: Tracking changes to the SoA and maintaining a version history.

Examples of "Statement of Applicability (SoA)":

1. Implementation of All Controls: A company implements all relevant ISO 27001 controls to ensure comprehensive security coverage.
2. Exclusion of Certain Controls: Certain controls are excluded because they are not relevant to the organization (e.g., physical security controls in a purely virtual environment).
3. Partial Implementation: Some controls are partially implemented, tailored to the specific needs and risks of the organization.
4. Regular Review: The SoA is regularly reviewed and updated to address new risks or changes in the organizational structure.
5. Justified Exceptions: A company excludes a specific control, but thoroughly documents the reasons and corresponding compensatory measures.