Audit & Assurance

Statement of Applicability (SoA)

Mandatory ISO 27001 document listing applicable Annex A controls with justification for inclusion or exclusion.

The SoA is the auditor's primary scoping artefact. Every applicable control must reference an implementation status, a justification and a control owner. Exclusions require an explicit, defensible reason.