Statement of Applicability

The Statement of Applicability lists every control of ISO 27001 Annex A. Per control you see whether it applies or is excluded, the reason, the basis (risk analysis or best practice) and the status.

You change a control from the clause itself: open it and choose Edit. An excluded control needs a reason.

Download the statement as PDF for your auditor, or as CSV to work with it in a spreadsheet. The PDF of the statement is part of the Business plan.