# Statement of Applicability (SoA)

> **The signature ISO/IEC 27001 document** – mandatory cl.6.1.3 d.
> Lists ALL Annex A controls (93 in the 2022 revision) with:
> included/excluded, justification, implementation status. Auditors
> will walk this table row by row.

| Field | Value |
|-------|-------|
| Document ID | DOC-ISMS-011 |
| Standard | ISO/IEC 27001:2022 |
| Version | N.N |
| Approved by | Top management |

## Control groups (Annex A:2022 structure)

- A.5 Organizational controls (37)
- A.6 People controls (8)
- A.7 Physical controls (14)
- A.8 Technological controls (34)

## Applicability matrix

| Control | Title | Applicable? | Justification | Implementation | Evidence / doc ref |
|---------|-------|-------------|---------------|----------------|---------------------|
| A.5.1 | Policies for information security | Yes | Core ISMS requirement | Implemented | DOC-ISMS-001 |
| A.5.2 | Information security roles | Yes | RACI defined | Implemented | DOC-ISMS-001 §3.2 |
| A.5.3 | Segregation of duties | Yes | Critical ops split | Partial | review NN |
| A.5.7 | Threat intelligence | Yes | Needed for risk ID | Implemented | feed + triage |
| A.5.9 | Inventory of assets | Yes | required | Implemented | DOC-ISMS-012 |
| A.5.10 | Acceptable use | Yes | required | Implemented | POL-AUP-001 |
| A.5.26 | Incident response | Yes | required | Implemented | DOC-ISMS-020 |
| A.5.31 | Legal requirements | Yes | required | Implemented | DOC-ISMS-014 |
| A.5.34 | Privacy & PII | Yes | GDPR scope | Implemented | DPIA process |
| A.6.3 | Awareness & training | Yes | staff handling data | Implemented | training records |
| A.7.4 | Physical monitoring | Partially | office only | Implemented | badge logs |
| A.8.1 | Endpoint protection | Yes | laptops in scope | Implemented | MDM policy |
| A.8.9 | Configuration mgmt | Yes | systems hardening | Partial | baseline doc |
| A.8.15 | Logging | Yes | incident forensics | Implemented | SIEM |
| A.8.16 | Monitoring activities | Yes | detection | Implemented | alerts |
| A.8.24 | Cryptography | Yes | data at rest/transit | Implemented | enc policy |
| ... | *(repeat for all 93 controls)* | | | | |

## Justification of exclusions

| Control | Why excluded |
|---------|--------------|
| A.N.N | Reason – must be defensible to auditor |

## Approval & linkage

- Justification references risk treatment plan (DOC-ISMS-013)
- Approved by management – date + signature
- Reviewed at least annually and after incidents