The
Statement of Applicability (SoA) is one of the key documents that you will need
to produce for your ISO 27001 Information Security Management System (ISMS).
Part of the risk assessment and Information Security Management Systems component of ISO 27001, it’s a framework of policies surrounding the legality, physicality and technicality of your cyber security systems. Completion of the statement of applicability (SoA) is a requirement of the ISO: a document you have to develop, prepare and submit as part of your steps toward best practice data management systems.
There are
no exact rules for developing your SoA as ISO 27001 recognises that details of
cyber security are unique to your business’ requirements, however you must
include:
·
An
explanation of the elements of the security controls you’ve chosen to mitigate
risks as well as justification for why you’ve included them. These are decided
through performing a gap analysis and risk assessment in the starting stages of
your ISO 27001 certification.
·
Whether
the chosen controls have been implemented. If they haven’t, you must state when
you intend to implement them.
·
If
you’ve excluded any part of ISO 27001’s Annex A – a list of 133 controls and
explanations of what they are and what they do – and why.
The SoA is
a crucial, mandatory report for ISO 27001 certification. It’s also an essential
report for the management and control of your ISMS.
ISO/IEC
27001:2013 states that, as part of the risk assessment process, organisations
must produce an SoA that contains:
·
The
necessary controls
·
Justifications
for their inclusion
·
Whether
the necessary controls have been implemented or not
·
Justifications
for excluding any of the Annex A controls.
ISO 27001
requires an ISMS to take
into account and document your organisation’s legal, statutory, regulatory and
contractual requirements for information security, and your approach to meeting
them. The SoA will record the controls that you select to meet these
requirements and whether they were implemented for reasons other than the risk
assessment.
The SoA is
a useful document for everyday operational use, because it provides
comprehensive coverage of your organisation’s information security measures.
You can refer to it to understand how and why your organisation is tackling certain risks and accepting others.
This is
especially important when ensuring continual improvement within your
organisation. You can assess whether the controls you’ve implemented are
working as intended and assess whether other controls might be more suitable.
Likewise,
you can review why you chose to accept risks and determine whether the threat
landscape has increased significantly enough to warrant a change.
An SoA also has significant regulatory consequences. If you are investigated for a data breach, you can use your SoA to justify your information security controls and prove that your defences were implemented in line with an ISO 27001-compliant risk assessment.
User questions & answers