Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Training Camp • Cybersecurity Glossary
Statement of Applicability SoA: the mandatory ISO 27001 document listing selected Annex A controls with justification and implementation status.
Statement of Applicability SoA Definition: Statement of Applicability SoA: the mandatory ISO 27001 document listing selected Annex A controls with justification and implementation status.
The Statement of Applicability SoA is a core ISO/IEC 27001 document that lists the Annex A controls an organization has selected, justifies their inclusion or exclusion, and records their implementation status. It links identified risks from the risk assessment to the chosen controls, providing auditors a traceable map of how the information security management system addresses each requirement. The SoA is mandatory for ISO 27001 certification and must be kept current as risks and controls evolve.
Turn knowledge into credentials with our instructor-led cybersecurity boot camps.
View All Courses →