What is a Statement of Applicability?
Although we know it can be time-consuming and difficult to complete, the Statement of Applicability forms a fundamental part of your information security management system (ISMS). It’s also one of the most important documents you’ll need to develop in order to gain ISO 27001:2022 certification.
Put simply, the Statement of Applicability (SoA) practices information protection as its top priority. The SOA holds ISO 27001 certification and is benchmarked to the Annex A controls set in that standard.
The importance of the ISO 27001 Statement of Applicability
The Statement of Applicability (SoA) provides a summary window of the information security controls currently used by the organization. A review of the ISMS documents will include audit requirements related to security. In addition, the SoA is a required document that certified organizations are required to produce in order to gain certification from an ISO Standards body.
The documentation is important during Stage 1 and 2 audits. With our ISO 27001 Online Exams, you’ll find your certification very easy in a convenient and secure environment.
The auditor is responsible for reviewing the information asset inventory and identifying risks. They then consider the evaluation and treatment of those risks, as well as look for physical evidence that confirms your organization has implemented controls effectively to address the identified risk.
The Statement of Applicability (SoA) and Scope are a report that provides information on the products and services, as well as business processes, of your organization. The report will include information about people involved in your business, any facilities used for processing data, and systems used by your organization.
If you have customers who want to ensure the ISO certification addresses their website and other digital assets, they may need to see the Scope and SoA before making a purchase.
It’s no good having an ISO certification for AU head office keywords when the identified risks is taking place in an offshore building with resources that are out of scope. That’s one of the reasons why certification bodies now advocate for ‘whole organization’s certifications, which may require a broader and deeper definition of what is covered.
In summary, a simple and well-confronted SOA document which is easily readable by all parties will tell the story of how and why the applicable and implemented Annex A controls are taking place. This gives major confidence in auditors, other interested parties, and ultimately to the organization that they are taking their information security management seriously.
What information needs to be included in the Statement of Applicability?
Before you submit an application for the SoA, remember that it will require a minimum set of information.
A list of the 114 Annex A controls
Whether the control is implemented or not
Justification for its inclusion or exclusion
A brief description or how each applicable control is implemented, with reference to the policy and control that describes it in the right detail
Another benefit to using the Statement of Applicability is that it helps identify how the control system is connected. Imagine the situation when an auditor turns up and your spreadsheet showing 114 controls no longer accurately reflects what controls are in place.
One of the most common reasons for failing an ISO 27001 audit is a lack of confidence in the administration of the ISMS. Having a standalone Statement of Applicability document rather than one integrated and automated reduces that risk.
How do you create the Statement of Applicability?
So, what’s the proper steps you need to take in order to put together an organizational assessment? Here’s a breakdown of the process.
Understand the Requirements
If you want to implement an ISO 27001 Statement of Applicability, the first step is understanding what the requirements actually are. Sometimes they can be overwhelming when it comes to information security.
ISO 27001 is an internationally recognized standard that creates a framework for organizations to manage information security policy. It outlines requirements for organization specific security management, information security incident response plans and much more.
Conduct a Risk Assessment
For the best results, you should use a risk-based approach to writing your ISO 27001 Statement of Applicability. You should conduct a risk assessment report because this step helps to identify relevant and appropriate measures that will keep your business protected from potential losses.
You’ll want to use the risk assessment you’ve already completed as a starting point.
If not, start by:
Determining the Appropriate Methodology
You need to decide which risk assessment methodology makes the most sense for your organization. You should choose a risk assessment methodology that is tailored to your particular risks and current circumstances, which include thinking about how you are planning to mitigate those risks.
The bottom line is that there are three approaches risk treatment plan can take: qualitative, or judgement with a low to high scale of probability; quantitative, which uses mathematical formulas to calculate the monetary losses of certain risks; and combination methods like asset-based or threat-based.
Looking for Guidance
In order to uncover potential threats to your organization, you can work with a cybersecurity consultant. They may recommend strategies or tools that they’ve used on similar clients in your field of expertise. This can help you form your own plan and implement the best anti-threat technologies for your business.
The risk assessment process can be difficult, whether you’re a new organization or just starting out with something new. Getting input from others who’ve had experience with the proper risks makes preparing for them much easier.
Determine Your Risk Management Strategy
This is the point where your business can decide what they need to do to stay safe on their website. For example, an organization may decide to implement encryption solutions for securing sensitive data.
Once you have defined all parts of your risk management strategy, you will have a clear picture of what type(s) of controls are best suited for addressing each component within your IT system.
How to save time when writing your Statement of Applicability
The Statement of Applicability (SoA) typically takes a long time to put together for the many steps involved and work that must be done in order to create it. At this point, it should be little wonder why it takes so much time for an organization to go through the required steps:
Consider the issues, interested parties and scope of the ISMS
Make sure to identify the information assets and processing facilities that are at risk.
Conduct a thorough risk analysis to evaluate and assess the risks associated with the consistent safety of information.
Evaluate the impact of legislation on your business and identify other information security risks.
Decide on how to implement the control in terms of policy, procedure, people, technology and etc.
Then create the SoA document itself with those justifications about applicability being clear.
The inclusion of the control detail, risks and assets is ideal to show how ISMS works.
And help you use it for your business on an ongoing basis.
The ISMS is an important part of keeping a company safe. While it’s often difficult to set up in an organization, it’s even more difficult to do poorly. This is why doing the ISMS correctly and comprehensively is vital for ensuring your organization stays compliant.
Importance and advantages of Statement of Applicability
The SoA (Security-Oriented Applications) allow real-time, traceable control across all systems connected to the data. This broad vision of what your organization is doing to protect its information and contribute to identification, organizational and record security measures in place gives you a big picture view of where you stand.
The Risk Assessment report allows justifying the inclusion or exclusion of each control, aspects that are not included in the Risk Assessment.
Passionate about information security? Organizations that want to develop and implement an Information Security Management System (ISMS) are required to have a SoA document.
By documenting controls, stating what they are and whether or not they have been implemented, field auditors can ensure compliance with the published policies and procedures.
