The Statement of Applicability (SoA) register runs on the Company Workspace. Keep the originals of policies, procedures and records in a folder on your own computer; the register holds only, for each control, whether it applies, the implementation status, the justification and the location of evidence (file name) (the justification, implementation method, evidence location and owner are encrypted with a different key for each company).
Statement of Applicability (SoA) register: the ISO/IEC 27001 and ISO/IEC 42001 6.1.3 d) Statement of Applicability as operational data

For each Annex A control (93 in 27001, 38 in 42001), enter applicable, partially applicable or excluded and its justification, together with the implementation status, method, evidence, owner, target date and review date. You start by importing the table from the results of step 7 (Introduction of Controls and Statement of Applicability) and step 4 (draft) of ICT Management System Operation Guide, and export the approved revision (Rev) as an Excel file and as step 7 input text. This register is the master. It is linked in both directions with the control numbers entered in the risk assessment rows of AI and Information Asset Lifecycle Management, and operational data such as incidents, vulnerabilities, backups, access reviews, changes, suppliers, training, documents and internal audits is attached to each control as a count of evidence.

  1. ① StartImport the Statement of Applicability table from the step 7 results, or expand all controls of the standard on your pass as "Under review".
  2. ② For each controlEnter whether it applies and the justification, together with the implementation status, method, evidence location, owner and target date. An exclusion needs a justification.
  3. ③ ChecksSee what remains under review, exclusions with no justification, target dates and reviews overdue, controls excluded but used in risk treatment, "implemented" with no evidence, and the A.5.31 legal basis (compliance obligations register) and the review after a law amendment.
  4. ④ Revision approval and comparisonWhen approved, all controls are saved as a revision (Rev) at that point and exported as an Excel file and as step 7 input text. The revision comparison tab shows only the controls that changed between two revisions (or the current register).
Principles to follow: Control names are not the sentences of the standard text but summaries in plain language (the numbers follow Annex A of ISO/IEC 27001:2022 and ISO/IEC 42001:2023; the Korean names in KS X ISO/IEC 27001 are "To be confirmed"). A person decides applicability and exclusion and approves the revision. Operational data evidence is read as counts and dates only, and the judgment is for reference. Data is not used for AI training.

My Statement of Applicability (SoA) register

Loading…