A Statement of Applicability (SoA) is a core ISO/IEC 27001 document that lists the security controls an organization has selected, justifies their inclusion or exclusion, and records their implementation status. It links identified risks to the controls addressing them, providing a traceable summary of the control environment. Auditors rely on the SoA to scope certification, making it a central artifact of a data center operator's ISMS.
Category: Standards & Governance · Subcategory: Risk & Governance · Part of the AIDC Technical Terminology reference.