The Statement of Applicability exists because ISO 27001 does not require an organisation to implement every control — it requires the organisation to choose controls deliberately, based on its risk assessment, and to justify those choices. This is a fundamental feature of the standard: security is risk-driven, not prescriptive. Two organisations in the same industry may legitimately implement different control sets because their risks, environments, and risk appetites differ. The SoA is where those decisions are documented and made defensible, and it is therefore the document that most clearly shows whether the ISMS is a reasoned system or a rote exercise.
The SoA is built directly from the risk assessment. The risk assessment identifies risks; the risk treatment plan decides how each will be handled — modified by controls, retained, avoided, or shared; the controls selected to modify risks are drawn from the control catalogue in ISO/IEC 27002 (Annex A in the 2022 revision, which contains 93 controls). For each control, the SoA records whether it is applicable to the organisation, the justification for that decision, and the current implementation status. A control that is excluded needs as much justification as one that is included — the auditor will ask why it is not relevant.
The SoA is a living document, not a one-time artifact. As the risk assessment is updated, as the environment changes, as incidents reveal new risks, and as the organisation matures, the SoA is revised to reflect the current control decisions. ISO 27001 requires that the SoA be maintained and that it be consistent with the risk assessment and risk treatment plan at all times — meaning a discrepancy between the documented risks, the chosen controls, and the SoA is a finding. This is why the SoA, the risk assessment, and the risk treatment plan are best managed together, with changes propagated across all three.
The certification auditor treats the SoA as a primary audit input. Stage 1 of the certification audit reviews the documentation, and the SoA is examined closely: does it cover all the catalogue controls, are the justifications coherent, and is it consistent with the risk assessment? Stage 2 then tests that the controls the SoA says are implemented actually operate. A SoA that claims controls are in place when they are not, or that excludes controls without justification, will generate findings and can prevent certification. The discipline of maintaining an accurate SoA is therefore both an audit necessity and a genuine management discipline.
Passeca produces and maintains Statements of Applicability as part of its ISO/IEC 27001 implementation work, ensuring each control decision is justified, the SoA is consistent with the risk assessment and risk treatment plan, and the document is auditable from day one. The SoA is typically managed in a GRC platform — Passeca delivers this work on the Hyperproof platform — so that changes to risk, controls, and evidence are propagated automatically, and the SoA is always current and audit-ready. This is the operational difference between an SoA maintained as a spreadsheet and one maintained as part of an integrated management system.