Statement of Applicability (SoA)
Statement of Applicability: the ISO 27001 document declaring which Annex A controls you apply and why.
The SoA (Statement of Applicability) is one of the most important documents in an ISO 27001 implementation. For each of the 93 Annex A controls you declare whether it is applied, and if not, you justify the exclusion. The SoA demonstrates to an auditor that control selection is driven by risk analysis, not by copying a checklist.
The most common mistake is marking every control as applicable. An auditor will spot this within minutes, because no organisation genuinely needs everything equally. Excluding a control is not a weakness, provided the exclusion is justified.
The SoA lives alongside the management system: as risk changes, the selection and status of controls changes too. An up-to-date SoA is the evidence that the ISMS is genuinely operational, not something created once before certification.
In practice: see the relevant RealSec module.
Compliance that connects.
Terms are the map. RealSec ties them to processes, systems and vendors in one engine.