ISO 27001 Statement of Applicability Software

WHAT THE SoA ACTUALLY GOVERNS 

The Statement of Applicability is not a catalogue of software features and it is not a declaration that every Annex A control must be adopted. It records which controls the organisation has determined are necessary, why controls are included, whether they are implemented and why any Annex A controls are excluded. 

The SoA should make sense when read alongside the ISMS scope, information-security risk assessment, risk-treatment process and relevant legal, regulatory, contractual and customer requirements. 

Each entry needs an intelligible applicability position and rationale. A status without context does not explain the organisation’s reasoning or accountability. 

Ownership, implementation, evidence, approval and review should remain controlled as systems, threats, suppliers, obligations and business activ ities change.

Zebsoft structures and connects the record. The organisation decides what is necessary and remains accountable for that decision. 

RISK TREATMENT BEFORE CHECKLISTING 

The organisation determines the controls needed to treat its information-security risks. Annex A is then used as a reference to check that necessary controls have not been omitted. Controls may also arise from legislation, regulation, contracts, customer requirements, sector rules, technology architecture or the organisation’s own design.

A copied control list with generic justifications may look complete while concealing weak reasoning. The better question is not “Have we ticked every box?” but “Can we explain why this control is or is not necessary in our context?” 

THE GOVERNED SoA LIF ECYCLE

Zebsoft can organise the work around the SoA while keeping decision authority with competent people. 

01 

Authorised management establishes the boundaries, interfaces, activities, locations, technology and exclusions relevant to the ISMS. 

02 

People identify information-security risks, evaluate them using the approved method and determine treatment priorities. 

03 

Control needs are selected from risk treatment, obligations and operational context—not generated from a generic prompt. 

04 

Competent owners decide inclusion or exclusion and record the reasoning for the organisation’s position. 

05 

Accountable owners define what will be implemented, by whom, where, when and with what acceptance criteria. 

06 

Policies, configurations, training, supplier records, tickets, tests and other evidence are connected to the relevant control. 

07 

Authorised people challenge the rationale, resolve gaps, accept residual risk and approve the controlled SoA. 

08 

Risk, incidents, audits, technology and obligations trigger review so the SoA does not become a dated snapshot.

ONE CONNECTED CONTROL REGISTER 

The platform provides structure, routing and traceability around each control record. Configuration should reflect the organisation’s own ISMS design and authority model. 

Maintain the control reference, title, theme, source and any organisation-specific control without losing its provenance. 

Record inclusion or exclusion reasoning in a required field rather than leaving an unexplained status in a spreadsheet. 

Distinguish planned, partly implemented, implemented and review states using the organisation’s approved definitions. 

Allocate responsibility for maintaining the control and its evidence while preserving management accountability. 

Connect controls to identified risks, treatment actions and residual-risk decisions so the reasoning can be followed. 

Associate approved documents, records, audits, training, tests, incidents and actions without treating an attachment as proof by itself. 

Set review dates, notifications and escalation paths appropriate to risk, change and the organisation’s governance rules. 

Retain changes to status, rationale, ownership, evidence and approval so reviewers can understand how the position evolved. 

DECISIONS BELONG TO PEOPLE 

Responsibility cannot be delegated to an algorithm. Zebsoft can route decisions to the right role and retain the record of review, but the organisation defines who is competent and authorised. 

Sets direction, provides resources, reviews performance and remains accountable for the effectiveness of the ISMS. 

Coordinates the SoA, protects its integrity and ensures decisions are routed through the agreed governance process. 

Evaluates treatment choices and makes or escalates residual-risk acceptance within delegated authority. 

Maintains implementation, operational evidence, review activity and actions for the assigned control. 

Independently examines conformity and effectiveness; the auditor should not own the controls being audited. 

An AI-generated recommendation may inform these people. It never replaces their competence, authority, professional judgement or recorded decision. 

ISO/IEC 27001:2022 ANNEX A 

The 2022 control set is organised into four themes. Zebsoft can present those controls alongside organisation-specific and externally required controls, while the organisation determines what is necessary. 

Governance, policies, responsibilities, suppliers, incidents, continuity, legal obligations and related organisational arrangements. 

Screening, terms of employment, awareness, disciplinary processes, remote working and reporting responsibilities. 

Perimeters, entry, facilities, monitoring, equipment, media, clear desk and protection from physical or environmental threats. 

Identity, access, authentication, malware, vulnerability, logging, network, development, configuration and other technical safeguards. 

ISO/IEC 27002 provides implementation guidance for information-security controls. It does not replace the organisation’s own risk treatment, design choices or accountability. 

FROM ASSERTION TO EXAMINABLE EVIDENCE 

A policy can show that a control was designed. A configuration record may show that it exists. Logs, samples, tests, interviews, incident outcomes and audit results may provide evidence about whether it operates and achieves the intended result. Those are different assurance questions.

Zebsoft can connect each control to several evidence types and retain review history. The reviewer decides whether the evidence is authentic, relevant, sufficient, current and within scope. 

KEEP THE SoA CURRENT 

A review date helps, but material change should also prompt attention. ZAP can monitor connected records and raise a review task without silently rewriting the approved SoA. 

New systems, cloud services, integrations, remote-working arrangements, data flows or material configuration changes may affect existing controls. 

Incidents, vulnerabilities, threat intelligence, audit findings and control failures may challenge assumptions or show treatment is inadequate. 

Scope, sites, services, suppliers, contracts, laws, customer requirements, acquisitions and organisational roles may change applicability. 

When the organisation adopts AI services, it should assess information assets, data flows, suppliers, access, privacy, accuracy, security, retention and human-oversight risks. The ISMS can govern those risks; ISO/IEC 42001 may provide a complementary management-system framework for responsible AI use. The two standards should not be presented as interchangeable. 

A REAL-WORLD REVIEW ROUTE 

The analytical output starts a controlled question. It does not produce an approved answer. 

01 

ZAP identifies that a control is marked implemented, but linked evidence is old and the owner has changed. 

02 

The ISMS manager decides whether the observation is relevant, false, duplicated or requires investigation. 

03 

The authorised control owner provides current evidence, raises an action or corrects the status with an explanation. 

04 

The appropriate risk or management authority reviews the impact and approves any change to applicability or risk acceptance. 

The result is a traceable chain from machine-raised observation to human examination, evidence and authorised decision. 

CONNECTED ISMS GOVERNANCE 

A static export may satisfy a document request, but the working governance value comes from links to the records that explain and test the control position. 

Connect control selection and treatment decisions to the live risk context. Explore risk management software. 

Link approved policies, standards, procedures and technical information without confusing documents with operating evidence. Explore document control. 

Use audits to examine whether controls operate as intended and route findings into accountable action. Explore the auditing platform. 

Connect role, competence, awareness, acknowledgements and assigned responsibility to the controls that depend on people. 

CLEAR PRODUCT BOUNDARIES 

INFORMED IMPLEMENTATION 

Use the licensed standards and competent advice applicable to your organisation. Product content is informative and is not certification, legal advice or a substitute for the standard. 

Specifies requirements for establishing, implementing, maintaining and continually improving an ISMS. View the official ISO standard page. 

Provides guidance and good practice for information-security controls used within an ISMS. View the official ISO standard page. 

Provides a management-system framework for responsible development, provision or use of AI systems. View the official ISO standard page. 

It can assist analysis and drafting for human review, but Zebsoft’s approach is not to manufacture an approved SoA. Scope, risk treatment, applicability, exclusions, evidence, risk acceptance and approval require authorised human judgement. 

No blanket answer should be generated. The organisation determines necessary controls through risk treatment and other requirements, uses Annex A as a reference and justifies exclusions in its SoA. 

No. It makes evidence accessible and traceable. Competent reviewers and auditors still evaluate authenticity, relevance, sufficiency, currency, operation and effectiveness. 

No. Zebsoft provides governance capability. Certification depends on the organisation’s ISMS, implementation, evidence and independent assessment against applicable requirements.