Title: ISO 27001 Statement of Applicability example

> A worked ISO 27001 Statement of Applicability example: link each treatment decision to an Annex A control, its implementation state and evidence.

Source: https://aegentra.co.uk/knowledge/iso-27001-statement-of-applicability-example  
Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT.  
Published: 2026-10-18  
Updated: 2026-10-21  
Licence: public web content; cite the source URL.

Practical guide / United Kingdom

# ISO 27001 Statement of Applicability: a worked example

Connect a treatment decision to an applicable control, its implementation state and the evidence behind it. Use this small fictional example to structure the conversation—not to replace the standard.

By [Harry Sidhu](https://aegentra.co.uk/about#director) — ISO 27001 Lead Implementer · Director and Principal Consultant, AegentraPublished 18 October 2026 · Updated 21 October 2026

Researched 18 October 2026. Examples are original fictional learning aids, not client results or legal advice.

## What is a Statement of Applicability?

The Statement of Applicability, or SoA, records the controls determined necessary for the ISMS, the justification for their inclusion and their implementation status, and the justification for excluding Annex A controls. It sits alongside risk assessment and treatment work. The SoA is not the same record as a risk register, and a list of policies does not prove that the selected controls operate.

## Where does this example start?

A fictional company sells a hosted appointment application. Its scope includes development, production operation and support. Shared identity services and its cloud provider matter to that scope. The team is considering access misuse, unsafe releases and interruption of service. The table shows a few original working records, not the full SoA or the standard’s control wording.

## How do you use the example safely?

Use a licensed copy of the applicable standard to check the required content and complete Annex A comparison. Record necessary controls beyond Annex A where appropriate. For every decision, retain enough rationale for someone outside the project to understand it. A supplier operating a control does not remove your responsibility to evaluate the relevant dependency.

## What makes a weak entry stronger?

“Implemented: yes” becomes more useful when the owner can point to a working record and explain its coverage. A release approval screenshot alone may omit emergency changes. A backup setting does not establish that restoration works. State what the evidence demonstrates and what remains open; do not mark unfinished work complete to make the document look ready.

## When should the record change?

Revisit it when the scope, risk decisions, obligations, technology or suppliers change, and when audit findings expose a mismatch. For example, adding customer-support access to production can change both the risk assessment and control arrangements. Keep the reason for a change, its owner and the approval history.

## A working record to discuss.

| Decision area | Why the fictional business needs it | State and evidence to examine | Owner / next action |
| --- | --- | --- | --- |
| Privileged access | Support staff can reach customer records. | Partly implemented: role list exists; access-review evidence is incomplete. | Service owner: confirm reviewers, exceptions and removal records. |
| Release control | An incorrect change can expose or interrupt the application. | Implemented for planned releases: inspect approvals and test evidence; verify emergency changes separately. | Engineering owner: trace a sample from request to deployment. |
| Recovery | Customers depend on appointment availability. | Backups configured; restoration capability still needs demonstration. | Operations owner: test restoration and record actual results. |
| Supplier assurance | Cloud hosting supports the scoped service. | Provider evidence collected; shared responsibilities not fully mapped. | Supplier owner: document customer-controlled settings and gaps. |

[Download the original working record (CSV)](https://aegentra.co.uk/downloads/iso-27001-soa-working-example.csv)
Starter example only. Adapt it to the agreed scope and use the applicable standards and qualified judgement.

## Check the primary sources.

[ISO: ISO/IEC 27001](https://www.iso.org/standard/27001)

## Choose the next step.

[Develop an ISMS and its SoA](https://aegentra.co.uk/services/govern/iso-27001)

[Use the audit planning checklist](https://aegentra.co.uk/knowledge/iso-27001-internal-audit-checklist)

[Study ISO 27001 implementation](https://aegentra.co.uk/academy/iso-27001-lead-implementer)