Statement of Applicability

Generate an SoA from your scope decisions — always in sync with what you've assessed.

What it contains

Your Statement of Applicability is generated from the scope decisions you’ve already made, so it’s never a separate document to keep in sync. For each requirement it shows:

Whether it’s included or excluded
For exclusions, the justification — inherited from the parent if you excluded a whole clause or theme
For included ISO/IEC 27001 Annex A controls, why it’s included (for example, risk treatment, legal, regulatory or contractual requirements) and any inclusion note
Your scope statement

Viewing and exporting

Open an adopted standard and go to its applicability page to review and edit decisions, singly or in bulk. Choose Download PDF for a formatted SoA to hand to your certification body.

Because the on-screen view and the PDF are built from the same data, they always agree.

Tips for a defensible SoA

Justify every exclusion in terms of your actual context. “Not applicable” on its own won’t survive Stage 1.
Revisit exclusions when your scope changes — a new remote workforce or a new product line can make a previously excluded control applicable.