Statement of Applicability (SoA)
A mandatory management system document that lists each Annex A control, whether it applies, why, and whether it has been implemented.
Certification auditors use the SoA as their main map of the management system, so a clear SoA shortens audits and shows customers which security or AI controls are actually in place.
Preparing for ISO/IEC 27001, a 40-person SaaS company lists all 93 Annex A controls, marks 81 as applicable with links to risk treatment decisions and policies, and justifies excluding 12, such as several physical controls, by its fully remote setup.
Excluding a control needs a defensible reason tied to risk, scope or obligations, not convenience. An SoA that is not kept in step with the risk treatment plan soon becomes paperwork that auditors will challenge.
In ISO/IEC 27001:2022, clause 6.1.3 d) requires an SoA that contains the necessary controls, the justification for including them, whether they are implemented, and the justification for excluding any Annex A control. ISO/IEC 42001:2023 uses the same clause structure for an AI Management System, with its own Annex A controls for AI. The SoA links the risk assessment, the risk treatment plan and the evidence that controls work.
Cybersecurity
Advisera — Statement of Applicability in ISO 27001: What is it and why does it matter? — https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/; Bastion — ISO 27001 Statement of Applicability (SoA): Complete Guide — https://bastion.tech/learn/iso27001/statement-of-applicability