ISO 27001/2-2022 Version - Statement of Applicability (Excel XLSX)

BENEFITS OF THIS EXCEL DOCUMENT

1. Provides you with well-tested Statement of Applicability to comply with the requirements of ISO 27001, Version 2022
2. Supports IT Consultants in ensuring the best creation of a Statement of Applicability for the new version of ISO 27K-2022 Version
3. Supports ISO 27 K Consultants in drafting a Statement of Applicability so that they can implement ISO 27K more effectively

ISO 27001 EXCEL DESCRIPTION

Editor Summary ISO 27001/2-2022 Version - Statement of Applicability is an XLSX spreadsheet by John Kyriazoglou that documents and provides an example SOA for the ISO 27001/2 2022 controls. Read more It includes 4 parts (Read me; Organizational Controls; People & Physical Controls; Technological Controls), an evaluation method and total assessment grade per domain, and a template with fields (Applicable, Reason for Exclusion, Implemented, Compliance Controls/Measures, Remarks, Implementation Status 0–5). Used by information security managers, ISO leads, auditors, and compliance officers to create or audit an SOA; available on Flevy with immediate digital download.

Use this spreadsheet when you must produce or audit a Statement of Applicability for ISO 27001/2 2022 — for example when preparing for certification, updating controls after a risk assessment, or documenting excluded controls.

  Information Security Manager mapping selected controls back to identified risks and recording Implementation Status per control.
  ISO 27001 Lead assembling the certification SOA and linking each control to the risk treatment plan.
  Internal Auditor assessing control effectiveness across domains and applying the spreadsheet’s evaluation method and total assessment grade.
  Compliance Officer documenting reasons for excluded controls and referencing corresponding policies or procedures.

The template’s requirement to map selected controls to risk-assessment outputs and to record implementation status aligns with standard ISO 27001 audit practice.

This spreadsheet describes fully the contents and an example of the controls included in the ISO 27001/2 2022 version Statement of Applicability (SOA). It can be used to create as well as to audit your own SOA. It is made up of 4 parts: Read me; Organizational Controls; People and Physical Controls; and Technological Controls. It also contains an evaluation methos and a total assessment grade for each area or domain of controls. The Statement of Applicability (SOA) is a central, mandatory part of the ISO 27001 standard for Information Security Management Systems and is the main link between the risk assessment & treatment and the implementation of your information security. The SOA explains which of the suggested controls from ISO 27001 Annex A you will apply, and justifies any excluded controls.
The statement of applicability (also known as an SOA) is a document which identifies the controls chosen for your environment, and explains how and why they are appropriate. The SOA is derived from the output of the risk assessment/ risk treatment plan and, if ISO27001 compliance is to be achieved, must directly relate the selected controls back to the original risks they are intended to mitigate.
Normally the controls are selected from ISO27001, but it is possible to also include own controls. A number of sector specific schemes are being introduced which stipulate additional mandatory controls.
The SOA should make reference to the policies, procedures or other documentation or systems through which the selected control will actually manifest. It is also good practice to document the justification of why those controls not selected were excluded.
The following template contains 4 sections, one for each ISO 27001 clause (A.5, A6, A7 and A8).
For each ISO 27001 clause (e.g., Organizational Controls (Clause A5) and control category (e.g., Policies for information security) you must note in each table and entry the fields noted below, as per the template presented next.
TEMPLATE: <Control Title>
Control Description: <description of control as per ISO standard>
(1) Applicable: <YES or No>.
(2) Reason for Exclusion: <Not required to control risk>
(3) Implemented: <YES/NO>
(4) Compliance Control(s) or Measure(s): <Title of compliance control>
(5) Remarks: <Any relevant comments>
(6) Implementation Status: <5= Full implementation and kept up-to-date; 4=Full implementation; 3=Partial implementation; 2=Initial implementation; 1=Exists but not implemented; 0=Inexistent>.

This template provides a structured approach to documenting your organization's information security controls, ensuring compliance with ISO 27001 standards. It facilitates a clear overview of your control implementation status, helping to identify gaps and areas for improvement in your security posture.

TOPIC FAQ

What is an ISO 27001 Statement of Applicability and what should it include?

A Statement of Applicability (SOA) identifies which controls will be applied in your environment and explains how and why they are appropriate. It must be derived from the risk assessment/risk treatment plan and map selected controls back to the original risks, typically referencing ISO 27001 Annex A.

Which sections of ISO 27001 controls does the 2022 SOA template cover?

The described SOA spreadsheet contains 4 sections, one for each ISO 27001 clause included in the template: Organizational Controls, People and Physical Controls, and Technological Controls, structured to cover clauses A.5, A.6, A.7, and A.8 as presented in the template for clauses A.5–A.8.

What fields should a practical SOA template include?

A practical SOA template should record Control Title, Control Description, whether the control is Applicable (YES/NO), Reason for Exclusion if not applicable, Implemented status (YES/NO), Compliance Control(s) or Measure(s), Remarks, and an Implementation Status score; the provided template uses a 0–5 implementation scale.

How should excluded controls be documented in an SOA?

Excluded controls should be documented with a clear justification explaining why they are not required to control the assessed risk, and the SOA should reference related policies/procedures for implemented controls; the template provides a dedicated "Reason for Exclusion" field for this purpose.

How can I evaluate overall implementation across control domains?

Use a domain-level evaluation method that aggregates control implementation scores to produce a total assessment grade for each control area or domain. The spreadsheet described includes an evaluation method and a total assessment grade to summarise each domain’s implementation status.

What should I consider when choosing an SOA template under budget or timeline constraints?

Prefer templates that directly map controls to the risk assessment, include fields for applicability and justification of exclusions, provide an implementation-status scale, and offer domain-level evaluation to speed audits and reporting; look specifically for an implementation-status scale and domain assessment capability.

I need to prepare an SOA for certification—what steps should I follow?

Start from your risk assessment/risk treatment output, select applicable controls (ISO 27001 Annex A or custom controls), document how each control will manifest via policies/procedures, justify exclusions, and record Implemented and Implementation Status. Flevy’s ISO 27001/2-2022 Version - Statement of Applicability provides a template to capture these items with Applicable, Implemented, and Implementation Status fields.

How do sector-specific schemes affect the controls I include in an SOA?

Sector-specific schemes can stipulate additional mandatory controls beyond ISO 27001 Annex A; your SOA should incorporate any required sector-specific controls and document them alongside Annex A controls so they appear in the SOA as additional mandatory controls where applicable.

Source: Best Practices in ISO 27001, ISO 27002 Excel: ISO 27001/2-2022 Version - Statement of Applicability Excel (XLSX) Spreadsheet, John Kyriazoglou