The statement of applicability
(SoA) is the main link between risk assessment and risk treatment in an enterprise
or in an organization within an enterprise and, therefore, is a requirement for
information security management system (ISMS) implementations. The SoA is a
continuously updated and controlled document that provides an overview of
information security implementation.
ISO
27001:2013 includes a documented statement (the SoA) with 35 control objectives
and 114 comprehensive controls to implement in an organizational ISMS. The
SoA should provide a reason for including or excluding any of the SoA controls
in the ISMS. Some organizations may not require all controls listed under the
SoA. For example, an organization that does not allow staff to work remotely
does not need to implement telecommuting-related controls. Likewise,
implementing only the ISO 27001:2013 controls may not sufficiently secure
enterprise systems. For example, an enterprise that subscribes to cloud
services might require additional controls.
SoA
preparation at the enterprise level requires significant coordination, time,
effort and upper-management commitment. The resulting SoA should be a short
chart of controls. The SoA must be reviewed and approved by top management or
an appropriate authority of the organization. Enterprises are often very
anxious about audits, and top management can put great pressure on information
security roles to eliminate nonconformity in an audit. The scenario at most
enterprises is often quite dramatic when an audit is nearing and during the
audit. Full attention and focus on the SoA during its preparation should result
in few or no surprises. If the SoA is created correctly, nothing major can fall
through the cracks regarding conformance to information security requirements.
Any nonconformance/noncompliance found by the auditors could be considered as
extra resources that would help organizations toward continual improvements.
The
process for producing the SoA and implementing the ISMS is very simple to
understand:
- The International Organization for Standardization (ISO) says that all activities must follow a method.
- That method or process must be documented.
- Processes must have controls, such as audits and reviews.
- The enterprise must have a security goal, which is stated in the information security policy.
- The enterprise must continuously verify and continuously improve the processes and controls.
User questions & answers