IT Governance Blog: the Statement of Applicability in ISO 27001

Documentation is a crucial part of any ISO 27001 implementation project, and one of the most important documents you need to complete is the SoA (Statement of Applicability).

In this blog, we explain what an SoA is, why it’s important and how to produce one.

What is a Statement of Applicability?

An SoA summarises your organisation’s position on each of the 114 information security controls outlined in Annex A of ISO 27001.

Clause 6.1.3 of the Standard states an SoA must:

• Identify which controls an organisation has selected to tackle identified risks;
• Explain why these have been selected;
• State whether or not the organisation has implemented the controls; and
• Explain why any controls have been omitted.

Every control should have its own entry, and in cases where the control has been selected, the SoA should link to relevant documentation about its implementation.

Which controls do you need to implement?

Organisations are only required to implement controls that are appropriate to the risks they face. They should determine which controls apply to them by conducting an ISO 27001 gap analysis and risk assessment.

These processes help organisations identify the risks they face, which they can match to the relevant control.

Annex A provides a useful outline of each control. Still, you’ll probably need something more in-depth when it comes to the implementation process. That’s where ISO 27002 comes in. It’s a supplementary standard in the ISO 27000 series, providing a detailed overview of information security controls.

ISO 27002 provides detailed information on each control, explaining how each one works and providing advice on how to implement it.

You’ll therefore benefit from having copies of both standards when creating your SoA.

Why is the Statement of Applicability important?

The SoA is a useful document for everyday operational use because it provides comprehensive coverage of your organisation’s information security measures.

You can refer to it to understand how and why your organisation is tackling certain risks and accepting others.

This is especially important when ensuring continual improvement within your organisation. You can assess whether the controls you’ve implemented are working as intended and assess whether other controls might be more suitable.

Likewise, you can review why you chose to accept risks and determine whether the threat landscape has increased significantly enough to warrant a change.

An SoA also has significant regulatory consequences. If you are investigated for a data breach, you can use the document to demonstrate that your defences were the result of an ISO 27001-compliant risk assessment.

Completing the Statement of Applicability

Completing the SoA can seem like a daunting task, but there are a few things you can do to simplify the process.

For a start, you should consider delegating each part of the process to the relevant person. You can ask someone in the HR department to provide information regarding the way they process personal data, and do the same for IT, marketing and so on.

Breaking it down this way saves time – as you aren’t relying on one person or a small team to understand every part of your organisation. It also makes it easier to understand specific issues that your business faces.

Another way to simplify the SoA is by consulting ISO 27002. This is a supplementary standard that focuses on the information security controls that organisations might choose to implement.

These controls are listed in Annex A of ISO 27001, but whereas that document simply outlines each control in one or two sentences, ISO 27002 dedicates an average of one page per control.

Finally, you should consider pooling together the documents you’ve created as part of your ISO 27001 implementation project – namely, the inventory of information assets, the risk assessment, the risk treatment plan.

Each of these documents provides a partial picture of your information security practices, but when you consider them altogether, you get a much clearer picture, which you can use to inform your SoA.

Save time writing your Statement of Applicability

Those looking for help creating their SoA should take a look at our ISO 27001 Toolkit.

The toolkit includes:

• A complete set of easy-to-use, customisable and fully ISO 27001-compliant documentation templates that will save you time and money;
• Simple dashboards and gap analysis tools to ensure complete coverage of the Standard; and
• Direction and guidance from expert ISO 27001 practitioners.

A version of this blog was originally published on 9 November 2017.