ISO 27001 Statement of Applicability: What and How

The Statement of Applicability is required by Clause 6.1.3 d). It contains the controls determined necessary for risk treatment, the justification for including each one whether implemented or not, the implementation status of each, and the justification for excluding any Annex A control. It is the document an ISMS audit turns on.

What ISO 27001 Clause 6.1.3 d) requires of the Statement of Applicability

Four things, and the wording repays reading closely.

• The necessary controls. Not “the Annex A controls”. The controls determined necessary to implement the chosen risk treatment options — which may include controls the organisation designed itself or took from elsewhere. The standard says its annex is not exhaustive.
• Justification for including each of those controls.
• Whether each is implemented or not — the implementation status. Read the clause carefully here, because it is often paraphrased as though implementation were a condition of inclusion. It is not: a control determined necessary but not yet in place still belongs in the Statement, justified, with its status shown honestly.
• Justification for exclusion of any Annex A control not included.

Note the asymmetry. Inclusions are justified for every necessary control. Exclusions are justified specifically for Annex A controls. A control the organisation invented and decided not to use does not need an exclusion justification, because it was never in the annex.

Clause references are to ISO/IEC 27001. Requirements are summarised rather than reproduced.

The Statement of Applicability, risk assessment and risk treatment plan: the confusion worth clearing first

The Statement of Applicability is not the risk treatment plan, and it is not the risk register. The three are different documents doing different jobs, and organisations merge them into a single spreadsheet often enough that an auditor should always check what they are actually looking at.

A combined spreadsheet is not a nonconformity. What matters is that each required element is present and can be produced. A merged document missing the exclusion justifications is missing them regardless of how tidy it looks.

Reading an ISO 27001 Statement of Applicability like an auditor: four questions per line

An auditor does not read a Statement of Applicability end to end. They sample it, and each sampled line gets the same four questions.

• Applicable or excluded?
• What is the justification, and does it survive contact with what this organisation actually does? This is the question that finds things. A justification is not a sentence; it is a claim about the business.
• Marked implemented — and can that be demonstrated? The Statement is a claim. Clause 8 is where you test it.
• Does the picture reconcile with the risk assessment and the risk treatment plan?

The fourth question is the one that separates an audit from a document review, because it is the only one that requires holding two documents open at once.

What a line of an ISO 27001 Statement of Applicability looks like

There is no prescribed format — the standard requires content, not a template — but a Statement that satisfies the clause has to carry these fields somewhere, and most are laid out as a table.

That last field is not required by the clause. An organisation that omits it has not breached anything, but it has made its own reconciliation impossible, and an auditor who cannot trace a control to a risk will spend the time asking instead. Worth mentioning as an opportunity for improvement rather than as a finding.

The three Statement of Applicability patterns that reliably produce findings

1. An exclusion with a weak or missing justification. The classic is cryptography — A.8.24 — excluded as “not relevant” by an organisation that plainly transmits sensitive data over public networks. The finding is not that the control was excluded. Excluding controls is legitimate and normal. The finding is that the justification does not hold, which is a 6.1.3 d) nonconformity.

Look for justifications that are really restatements: “not applicable to our business”, “covered elsewhere”, “out of scope”. Each of those may be true. None of them, on its own, is a justification.

2. A control marked implemented that operational evidence contradicts. The Statement says backups are tested; the operations team cannot produce a single restore test. It is found by asking for evidence rather than for the procedure, and it is the reason a Statement of Applicability is a claim to be tested rather than a document to be read.

The interesting part is which clause it belongs to. If the control is genuinely not operating, the finding is against the control and its clause 8 implementation. If the Statement claims a status that is untrue, there is a documented-information problem as well.

3. A mismatch with the risk assessment. A high-rated risk whose only treatment control is marked excluded. Or a risk assessment that identifies an exposure for which no control appears anywhere. This is the finding that says the two documents were written by different people at different times and never reconciled — and it usually means the risk process is not driving the control selection at all.

Two more Statement of Applicability patterns worth knowing

The Statement that is really an Annex A checklist. Every one of the 93 listed, all marked applicable, all marked implemented, justifications reading “required by ISO 27001”. This is a document produced to pass an audit rather than to record decisions. It is not automatically a nonconformity — but it is a reason to test the risk assessment hard, because the direction of travel has almost certainly been reversed.

The Statement with no non-Annex-A controls. Not a finding in itself. But an organisation with a genuinely risk-driven ISMS usually finds at least one necessary control the annex does not cover, and a Statement that maps exactly onto the annex and nothing else is worth a question.

Where the ISO 27001 Statement of Applicability is used outside an audit

Worth knowing, because it explains why organisations care about it more than about most of their ISMS documents.

The Statement of Applicability is routinely the document a certified organisation shares with customers, prospects and their own auditors as evidence of what it does. It travels. That gives an organisation an incentive to make it look complete, which is exactly the pressure that produces the all-93-applicable version described above — and it is a reason to read the justifications rather than the status column.

How the Statement of Applicability fits the ISO 27001 audit trail

The productive way to use it is as the middle of a trail rather than as a document to review.

• Take a real risk from the risk assessment — ideally one rated high.
• Check it has an identified owner, and that consequence and likelihood were assessed against defined criteria (6.1.2).
• Find which treatment option was chosen and which controls were determined (6.1.3 a and b).
• Find those controls in the Statement of Applicability. Applicable? Justified? Status? (6.1.3 d).
• Find them in the risk treatment plan, and check the plan is being progressed (6.1.3 e).
• Check the risk owner approved the plan and accepted the residual risk, with a record (6.1.3 f).
• Then go and watch the control operate (Clause 8).

The step that breaks tells you which requirement to cite. That mapping is the single most useful thing to carry into an examination: no owner points to 6.1.2; an unjustified exclusion or an unreconciled Statement points to 6.1.3 d); residual risks never accepted point to 6.1.3 f); a control that does not operate points to Clause 8.

The clause reference sets out the sub-clauses in full, and the risk vocabulary page takes apart the words the trail runs on.

What a good ISO 27001 Statement of Applicability looks like

Not long, and not beautiful. A Statement of Applicability that works has three properties.

Its justifications are specific to the organisation. They mention what the business does, not what the standard says. “We hold no payment card data and process none on our systems” is a justification. “Not applicable” is not.

It reconciles. Every high risk’s treatment controls appear in it and are applicable. Nothing marked applicable is orphaned from any risk.

It is current. A Statement that has not changed since certification, in an organisation whose risk assessment has been repeated and whose services have changed, is a document nobody is using. Version and approval dates are a fast first check, and they cost nothing to look at.

Frequently asked questions about the ISO 27001 Statement of Applicability

Where to go next: more ISO 27001 Lead Auditor exam preparation

• All 93 Annex A controls, by theme
• How plan-do-check-act maps onto the clauses
• The ISO/IEC 27000 family: which standard does what

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is PR373. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.