The Statement of Applicability (SoA) is a status report that outlines an organization's work on information security and is an integral component of the ISO 27001 standard. Essentially, it serves as a declaration of an organization's chosen level of information security in a given process, along with the rationale behind selecting respective measures. The SoA provides a valuable link between an organization's risk assessment and risk treatment.
The SoA is an indispensable tool in relation to information security, as it contains justifications for the inclusion or exclusion of specific security measures. As a result, an organization must evaluate all information security controls - including those that may not be applicable to a particular case - to ensure comprehensive and effective information security management. The SoA typically includes a list of security controls and their corresponding justifications for selection or exclusion.
The SoA can be a valuable tool for demonstrating compliance with external stakeholders, such as regulatory bodies or clients. It can also be used as a reference for ongoing security management, providing a clear overview of the security measures and their justifications. The SoA is an essential part of ISO 27001 certification, as it demonstrates that an organization has identified and implemented appropriate security measures to manage and mitigate its risks.