Free resource · Template
Statement of Applicability template — ISO/IEC 27001:2022
Clause 6.1.3 (d) asks for a Statement of Applicability that lists the necessary controls, why each is included, whether it's implemented, and why any Annex A control is excluded. This template lists all 93 Annex A controls with columns for each of those decisions. Control titles are short descriptors; refer to your licensed copy of the standard for the full text.
ApplicableYes or No. Every control must have a decision.
ReasonRisk treatment (R), legal or regulatory (L), contractual (C) or business requirement (B).
JustificationFor exclusions: the objective characteristic of your scope that makes it inapplicable.
Status & evidenceImplemented, partial or planned — and where the evidence lives.
A.5Organizational controls
37 controls| Control | Title | Applicable | Reason | Justification | Status | Evidence / ref. |
|---|---|---|---|---|---|---|
| A.5.1 | Policies for information security | Y / N | ||||
| A.5.2 | Information security roles and responsibilities | Y / N | ||||
| A.5.3 | Segregation of duties | Y / N | ||||
| A.5.4 | Management responsibilities | Y / N | ||||
| A.5.5 | Contact with authorities | Y / N | ||||
| A.5.6 | Contact with special interest groups | Y / N | ||||
| A.5.7 | Threat intelligence | Y / N | ||||
| A.5.8 | Information security in project management | Y / N | ||||
| A.5.9 | Inventory of information and other associated assets | Y / N | ||||
| A.5.10 | Acceptable use of information and other associated assets | Y / N | ||||
| A.5.11 | Return of assets | Y / N | ||||
| A.5.12 | Classification of information | Y / N | ||||
| A.5.13 | Labelling of information | Y / N | ||||
| A.5.14 | Information transfer | Y / N | ||||
| A.5.15 | Access control | Y / N | ||||
| A.5.16 | Identity management | Y / N | ||||
| A.5.17 | Authentication information | Y / N | ||||
| A.5.18 | Access rights | Y / N | ||||
| A.5.19 | Information security in supplier relationships | Y / N | ||||
| A.5.20 | Addressing information security within supplier agreements | Y / N | ||||
| A.5.21 | Managing information security in the ICT supply chain | Y / N | ||||
| A.5.22 | Monitoring, review and change management of supplier services | Y / N | ||||
| A.5.23 | Information security for use of cloud services | Y / N | ||||
| A.5.24 | Information security incident management planning and preparation | Y / N | ||||
| A.5.25 | Assessment and decision on information security events | Y / N | ||||
| A.5.26 | Response to information security incidents | Y / N | ||||
| A.5.27 | Learning from information security incidents | Y / N | ||||
| A.5.28 | Collection of evidence | Y / N | ||||
| A.5.29 | Information security during disruption | Y / N | ||||
| A.5.30 | ICT readiness for business continuity | Y / N | ||||
| A.5.31 | Legal, statutory, regulatory and contractual requirements | Y / N | ||||
| A.5.32 | Intellectual property rights | Y / N | ||||
| A.5.33 | Protection of records | Y / N | ||||
| A.5.34 | Privacy and protection of PII | Y / N | ||||
| A.5.35 | Independent review of information security | Y / N | ||||
| A.5.36 | Compliance with policies, rules and standards for information security | Y / N | ||||
| A.5.37 | Documented operating procedures | Y / N |
A.6People controls
8 controls| Control | Title | Applicable | Reason | Justification | Status | Evidence / ref. |
|---|---|---|---|---|---|---|
| A.6.1 | Screening | Y / N | ||||
| A.6.2 | Terms and conditions of employment | Y / N | ||||
| A.6.3 | Information security awareness, education and training | Y / N | ||||
| A.6.4 | Disciplinary process | Y / N | ||||
| A.6.5 | Responsibilities after termination or change of employment | Y / N | ||||
| A.6.6 | Confidentiality or non-disclosure agreements | Y / N | ||||
| A.6.7 | Remote working | Y / N | ||||
| A.6.8 | Information security event reporting | Y / N |
A.7Physical controls
14 controls| Control | Title | Applicable | Reason | Justification | Status | Evidence / ref. |
|---|---|---|---|---|---|---|
| A.7.1 | Physical security perimeters | Y / N | ||||
| A.7.2 | Physical entry | Y / N | ||||
| A.7.3 | Securing offices, rooms and facilities | Y / N | ||||
| A.7.4 | Physical security monitoring | Y / N | ||||
| A.7.5 | Protecting against physical and environmental threats | Y / N | ||||
| A.7.6 | Working in secure areas | Y / N | ||||
| A.7.7 | Clear desk and clear screen | Y / N | ||||
| A.7.8 | Equipment siting and protection | Y / N | ||||
| A.7.9 | Security of assets off-premises | Y / N | ||||
| A.7.10 | Storage media | Y / N | ||||
| A.7.11 | Supporting utilities | Y / N | ||||
| A.7.12 | Cabling security | Y / N | ||||
| A.7.13 | Equipment maintenance | Y / N | ||||
| A.7.14 | Secure disposal or re-use of equipment | Y / N |
A.8Technological controls
34 controls| Control | Title | Applicable | Reason | Justification | Status | Evidence / ref. |
|---|---|---|---|---|---|---|
| A.8.1 | User endpoint devices | Y / N | ||||
| A.8.2 | Privileged access rights | Y / N | ||||
| A.8.3 | Information access restriction | Y / N | ||||
| A.8.4 | Access to source code | Y / N | ||||
| A.8.5 | Secure authentication | Y / N | ||||
| A.8.6 | Capacity management | Y / N | ||||
| A.8.7 | Protection against malware | Y / N | ||||
| A.8.8 | Management of technical vulnerabilities | Y / N | ||||
| A.8.9 | Configuration management | Y / N | ||||
| A.8.10 | Information deletion | Y / N | ||||
| A.8.11 | Data masking | Y / N | ||||
| A.8.12 | Data leakage prevention | Y / N | ||||
| A.8.13 | Information backup | Y / N | ||||
| A.8.14 | Redundancy of information processing facilities | Y / N | ||||
| A.8.15 | Logging | Y / N | ||||
| A.8.16 | Monitoring activities | Y / N | ||||
| A.8.17 | Clock synchronization | Y / N | ||||
| A.8.18 | Use of privileged utility programs | Y / N | ||||
| A.8.19 | Installation of software on operational systems | Y / N | ||||
| A.8.20 | Networks security | Y / N | ||||
| A.8.21 | Security of network services | Y / N | ||||
| A.8.22 | Segregation of networks | Y / N | ||||
| A.8.23 | Web filtering | Y / N | ||||
| A.8.24 | Use of cryptography | Y / N | ||||
| A.8.25 | Secure development life cycle | Y / N | ||||
| A.8.26 | Application security requirements | Y / N | ||||
| A.8.27 | Secure system architecture and engineering principles | Y / N | ||||
| A.8.28 | Secure coding | Y / N | ||||
| A.8.29 | Security testing in development and acceptance | Y / N | ||||
| A.8.30 | Outsourced development | Y / N | ||||
| A.8.31 | Separation of development, test and production environments | Y / N | ||||
| A.8.32 | Change management | Y / N | ||||
| A.8.33 | Test information | Y / N | ||||
| A.8.34 | Protection of information systems during audit testing | Y / N |
Skip the spreadsheet
StayEvident generates your SoA from your scope decisions — and keeps it in sync.
Exclude a control or a whole theme once, record why included controls apply, and download the SoA as a PDF. How it works →
Prepared with StayEvident · stayevident.com · Template — adapt to your scope and risk assessment. Not legal or certification advice.