ISO 27001
Statement of Applicability
Generate the mandatory ISO 27001 Statement of Applicability (SoA) from your program: every Annex A control, its applicability, justification, and status, exported as a branded PDF.
The SoA is the document every ISO 27001 auditor asks for first, the required output of Clause 6.1.3 that says, for each Annex A control, whether it applies to you, why, and how it’s implemented. Keel builds it from the program you’re already running: every Annex A:2022 control, its applicability, a justification for each, and a live implementation status drawn from the controls you’ve mapped, then exports a branded, auditor-ready PDF.
The problem
The SoA is mandatory, and usually maintained by hand
Most teams keep their SoA in a spreadsheet that’s copied from a template and drifts out of date the moment a control changes. When the auditor asks for it, someone reconciles every Annex A row against the real program from memory. It’s the one ISO 27001 artifact you can’t skip, and the easiest one to let rot.
Capabilities
What the SoA does
Every Annex A:2022 control, pre-loaded
Keel ships the full ISO/IEC 27001:2022 Annex A set, the Organizational, People, Physical and Technological themes and every control within them, so your SoA starts complete instead of from a blank template.
Applicability that stays in sync
Applicability is driven by your scope: include or exclude a control on the SoA (or on the Scope page) and both update together, along with your readiness score. One decision, one place, no divergence between your SoA and your program.
A justification for every control
Record why each control applies (often from your risk assessment or a legal, regulatory, or contractual requirement) or the reason you’ve excluded it. Clause 6.1.3 asks for exactly this, and it prints on the SoA.
Implementation status, pulled live
For each Annex A control, Keel rolls up the status of the controls you’ve crosswalked to it (implemented, in progress, or a gap), so the SoA reflects your real posture instead of a static claim.
Document control built in
Set a version, the ISMS scope statement, and who approved the SoA and when. Those details print on the document header, so what you hand the auditor is a controlled record, not a loose export.
Branded, auditor-ready PDF
Export the whole SoA as a branded, print-ready PDF in a click, the artifact your certification auditor expects, generated from live data every time.
An Excel workbook for auditors who want a spreadsheet
The same document downloads as an Excel workbook: one row per Annex A control, separate columns for the justification for inclusion and the reason for exclusion, and a header block with your organization, scope and approval details. Use it when your auditor prefers to work from a spreadsheet. It holds the same rows and decisions as the PDF.
Filters for missing justifications and gaps
Filter Annex A by applicability, by implementation status, or down to the rows that still have no justification, and search by reference, title or justification text. Each row shows which of your controls back it, so a row marked “no control mapped” points straight at the work left to do. Filters change only the screen. Every export contains the full document.
No export from a partial read
If Keel cannot read part of the data the document is built from, the page says so and the PDF and Excel downloads are withheld until a reload succeeds. You never hand an auditor a short SoA that looks complete.
Outcomes
Why it matters
- Produce the mandatory ISO 27001 SoA without maintaining a spreadsheet
- Keep applicability, scope, and readiness in lockstep automatically
- Show a justification and a real implementation status for every Annex A control
- Hand your auditor a branded, current SoA PDF on demand
Get audit-ready, and prove it
The SoA is one module of a full GRC platform: controls crosswalked across every framework, so you collect evidence once and comply everywhere. Start free, no credit card, no sales call.
Frequently asked questions
What is a Statement of Applicability?
It’s the mandatory ISO 27001 document required by Clause 6.1.3 d. For every Annex A control it records whether the control is applicable, the justification for including or excluding it, and its implementation status. It’s typically the first artifact a certification auditor reviews.
What does Clause 6.1.3 d require the SoA to contain?
The necessary controls, the justification for including them, whether each one is implemented, and the justification for excluding any Annex A control. Keel’s columns follow that list item by item, so a row with an empty justification is visible before the auditor finds it.
How often should the SoA be updated?
ISO 27001 does not set a fixed interval. Update it when your risk assessment, risk treatment or ISMS scope changes, and review it before each surveillance or recertification audit. In Keel the applicability and implementation columns follow your scope and controls as they change. When you reissue the document, raise the version and record the new approval in document control.
How many Annex A controls does it cover?
All of them. ISO/IEC 27001:2022 Annex A has 75+ controls across the Organizational, People, Physical, and Technological themes, and Keel pre-loads every one, so your SoA is complete from the start.
Where does the implementation status come from?
From your own controls. Keel crosswalks the controls you implement to the Annex A references they satisfy, then rolls those up per control, so the SoA shows implemented, in progress, or gap based on your live program, not a manual entry.
Can I exclude controls that don’t apply?
Yes. Mark a control excluded on the SoA (or on the Scope page) and record the justification. Excluding it removes it from your readiness calculation too, so your SoA and your program never disagree.
Can I export it for my auditor?
Yes. Export the full SoA as a branded, print-ready PDF, with your version, ISMS scope statement, and approver details on the header, or download it as an Excel workbook.
Related features: Controls & crosswalk · Evidence management · Readiness reports
Works with: ISO/IEC 27001
In the docs: Statement of Applicability