Statement of Applicability

All 93 Annex A controls with their applicability and its justification.

Produces the Statement of Applicability of ISO 27001: for each Annex A control, whether it applies, why, whether it is implemented and where the evidence is. You give the controls excluded with their justification; risks, policies and evidence already in your workspace are linked to it.

Columns of the register

ControlTitleThemeApplicableJustificationImplementation

1
Complete
Every Annex A control, grouped by theme.
2
Justified
Why each control is included or excluded.
3
Implementation
How each applicable control is implemented.

What you provide

Controls selected to treat your risks — Only needed if you do not select a risk treatment plan as a source. Annex A references, e.g. “5.15”, “8.5”.
Controls excluded and why — One control per entry with its justification.
Additional context — Anything the service should take into account.
Title — As it will appear on the result.
Author — Shown as the author of the deliverable; never filled in by the AI.