The Statement of Applicability is the document a certification auditor works from, and the column they actually test is justification, particularly for controls you have excluded. 'Not applicable' without a defensible reason is a finding.
Justify exclusions properly. An exclusion needs a reason tied to your scope or context: no in-house development, no physical datacentre. 'Not relevant to us' is not a justification and will be challenged.
Point at specific evidence. For each applicable control, name the artefact and where it lives. The SoA is the index an auditor navigates by, and vague references turn a short audit into a long one.
Keep it synchronised with the risk treatment plan. Controls applied because of a risk should trace back to that risk. An auditor checking consistency between the risk register, treatment plan, and SoA is checking whether the management system is real.
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
One row per Annex A control. Complete all 93; this shows the structure and representative rows.
| Control | Title | Applicable | Justification | Implementation status | Evidence location | Owner | Linked risk |
|---|---|---|---|---|---|---|---|
| A.5.1 | Policies for information security | Yes | Required for all organisations | Implemented | Policy register; board approval minutes | CISO | R-12 |
| A.5.7 | Threat intelligence | Yes | Relevant given internet-facing services | Partial | Vendor advisory subscriptions; no formal process | Security | R-04 |
More free templates IT teams use alongside this one.
Most ISO 27001 gap assessments focus on Annex A and skip clauses 4 to 10, which is backwards: the management system clauses are mandatory and are where certification audits most often find problems.
Risk registers fail in one of two ways: everything scores medium, or the register is written once for an audit and never opened again. This one forces a treatment decision and a review date on every row, because a risk with neither is a note, not a managed risk.
A SOC 2 Type II does not test whether you have a control. It tests whether the control operated throughout the period, and asks you to prove it with artefacts from specific dates. This tracker is organised around that reality: per control, per evidence artefact, per sample date.
The ISO 27001 document listing all 93 Annex A controls with, for each, whether it applies, the justification, implementation status, and where the supporting evidence lives. Auditors use it as the index for the whole assessment.
Yes, provided the justification ties to your defined scope or context: no in-house development, no premises under your control. Vague reasons such as organisational size are routinely challenged and usually rejected.
93, organised into four themes: organisational (37), people (8), physical (14), and technological (34). The 2022 revision consolidated the previous 114 controls and introduced eleven new ones.
