A Statement of Applicability (SoA) is a document that outlines the controls that an organisation has implemented or plans to implement to manage its information security risks. It is an essential component of an ISO27001-compliant ISMS.