Statement of Applicability (SoA)

An ISO 27001 document listing every Annex A control, whether it applies, and the justification.

The Statement of Applicability is a required ISO 27001 artefact that explicitly maps each of the ~93 Annex A controls to applicable/not-applicable with a one-line justification per control. The SoA is one of the first things an ISO 27001 auditor asks for and is reviewed in both Stage 1 and recertification audits.