Statement of applicability
- Term
- Statement of applicability
- Exam
- CISA & CISM
- Definition
The ISO/IEC 27001 document listing selected Annex A controls, why they were included and why any were excluded.
- Explained
The statement of applicability lists every ISO/IEC 27001 Annex A control, whether it is applied, why, and why any are excluded. It connects the risk treatment plan to the controls actually implemented and is a key certification document.
- In practice
A table showing each ISO/IEC 27001 Annex A control, whether it applies and why.
- Often confused with
- Risk treatment plan
- Exam angle
Links risk treatment to the controls applied.
- Related