What is the Statement of Applicability?
The Statement of Applicability (SoA) is a fundamental component of an organization’s Information Security Management System (ISMS) and a critical document in achieving ISO 27001 certification.
An organization’s Statement of Applicability benchmarks against ISO 27001’s full Annex A control set and includes justification for inclusion or exclusion of each control as part of the organization’s ISMS implementation. In addition, the SoA links an organization’s risk assessment with its risk treatment plan.
The Statement of Applicability is one of the first documents an auditor will review as part of the ISO 27001 audit process. The SoA helps the auditor understand the organization and what controls have been implemented and assessed as part of that organization’s audit.
{{cta_withimage2="/cta-modules"}}
.png)
.png)
.png)
.png)
.png)
.png)
.png)
Watch this on-demand demo to learn how Vanta’s Vendor Risk Management solution automates and streamlines security reviews so that you can spend less time on repetitive work and more time strengthening your security posture.
.png)
.svg)
.svg)
.png)
.png)
.png)