Statement of Applicability Software for US Teams

WHAT THE SoA ACTUALLY GOVERNS 

The Statement of Applicability is not a catalog of software features and it is not a declaration that every Annex A control must be adopted. It records which controls the organization has determined are necessary, why controls are included, whether they are implemented and why any Annex A controls are excluded. 

For a US organization, the SoA should reflect the ISMS scope, information-security risks, risk treatment and applicable federal, state, sector, contractual and customer requirements. Record which obligations apply to which services, locations and data flows; do not assume one control position covers every operation. 

Each entry needs an intelligible applicability position and rationale. A status without context does not explain the organization’s reasoning or accountability. 

Ownership, implementation, evidence, approval and review should remain controlled as systems, threats, suppliers, obligations and business activities change.

Zebsoft structures and connects the record. The organization decides what is necessary and remains accountable for that decision. 

RISK TREATMENT BEFORE CHECKLISTING 

The organization determines the controls needed to treat its information-security risks. Annex A is then used as a reference to check that necessary controls have not been omitted. Controls may also arise from legislation, regulation, contracts, customer requirements, sector rules, technology architecture or the organization’s own design.

A copied control list with generic justifications may look complete while concealing weak reasoning. The better question is not “Have we ticked every box?” but “Can we explain why this control is or is not necessary in our context?” 

THE GOVERNED SoA LIFECYCLE

Zebsoft can organize the work around the SoA while keeping decision authority with competent people. 

01 

Authorized management establishes the boundaries, interfaces, activities, locations, technology and exclusions relevant to the ISMS. 

02 

People identify information-security risks, evaluate them using the approved method and determine treatment priorities. 

03 

Control needs are selected from risk treatment, obligations and operational context—not generated from a generic prompt. 

04 

Competent owners decide inclusion or exclusion and record the reasoning for the organization’s position. 

05 

Accountable owners define what will be implemented, by whom, where, when and with what acceptance criteria. 

06 

Policies, configurations, training, supplier records, tickets, tests and other evidence are connected to the relevant control. 

07 

Authorized people challenge the rationale, resolve gaps, accept residual risk and approve the controlled SoA. 

08 

Risk, incidents, audits, technology and obligations trigger review so the SoA does not become a dated snapshot.

ONE CONNECTED CONTROL REGISTER 

The platform provides structure, routing and traceability around each control record. Configuration should reflect the organization’s own ISMS design and authority model. 

Maintain the control reference, title, theme, source and any organization-specific control without losing its provenance. 

Record inclusion or exclusion reasoning in a required field rather than leaving an unexplained status in a spreadsheet. 

Distinguish planned, partly implemented, implemented and review states using the organization’s approved definitions. 

Allocate responsibility for maintaining the control and its evidence while preserving management accountability. 

Connect controls to identified risks, treatment actions and residual-risk decisions so the reasoning can be followed. 

Associate approved documents, records, audits, training, tests, incidents and actions without treating an attachment as proof by itself. 

Set review dates, notifications and escalation paths appropriate to risk, change and the organization’s governance rules. 

Retain changes to status, rationale, ownership, evidence and approval so reviewers can understand how the position evolved. 

DECISIONS BELONG TO PEOPLE 

Responsibility cannot be delegated to an algorithm. Zebsoft can route decisions to the right role and retain the record of review, but the organization defines who is competent and authorized. 

Sets direction, provides resources, reviews performance and remains accountable for the effectiveness of the ISMS. 

Coordinates the SoA, protects its integrity and ensures decisions are routed through the agreed governance process. 

Evaluates treatment choices and makes or escalates residual-risk acceptance within delegated authority. 

Maintains implementation, operational evidence, review activity and actions for the assigned control. 

Independently examines conformity and effectiveness; the auditor should not own the controls being audited. 

An AI-generated recommendation may inform these people. It never replaces their competence, authority, professional judgment or recorded decision. 

ISO/IEC 27001:2022 ANNEX A 

The 2022 control set is organized into four themes. Zebsoft can present those controls alongside organization-specific and externally required controls, while the organization determines what is necessary. 

Governance, policies, responsibilities, suppliers, incidents, continuity, legal obligations and related organizational arrangements. 

Screening, terms of employment, awareness, disciplinary processes, remote working and reporting responsibilities. 

Perimeters, entry, facilities, monitoring, equipment, media, clear desk and protection from physical or environmental threats. 

Identity, access, authentication, malware, vulnerability, logging, network, development, configuration and other technical safeguards. 

ISO/IEC 27002 provides implementation guidance for information-security controls. It does not replace the organization’s own risk treatment, design choices or accountability. 

FROM ASSERTION TO EXAMINABLE EVIDENCE 

A policy can show that a control was designed. A configuration record may show that it exists. Logs, samples, tests, interviews, incident outcomes and audit results may provide evidence about whether it operates and achieves the intended result. Those are different assurance questions.

Zebsoft can connect each control to several evidence types and retain review history. The reviewer decides whether the evidence is authentic, relevant, sufficient, current and within scope. 

KEEP THE SoA CURRENT 

A review date helps, but material change should also prompt attention. ZAP can monitor connected records and raise a review task without silently rewriting the approved SoA. 

New systems, cloud services, integrations, remote-working arrangements, data flows or material configuration changes may affect existing controls. 

Incidents, vulnerabilities, threat intelligence, audit findings and control failures may challenge assumptions or show treatment is inadequate. 

Scope, sites, services, suppliers, contracts, laws, customer requirements, acquisitions and organizational roles may change applicability. 

When the organization adopts AI services, it should assess information assets, data flows, suppliers, access, privacy, accuracy, security, retention and human-oversight risks. The ISMS can govern those risks; ISO/IEC 42001 may provide a complementary management-system framework for responsible AI use. The two standards should not be presented as interchangeable. 

A REAL-WORLD REVIEW ROUTE 

A US service provider is preparing a customer security response. Its access-control record is marked implemented, but an acquisition has introduced another identity system. An AI observation starts a review; a competent owner verifies the facts. 

01 

ZAP flags an access-control record with old evidence and a changed owner. The reviewer checks whether the acquired business is covered by the recorded control. 

02 

The ISMS manager checks scope, customer commitments and the two identity systems before deciding what requires investigation. 

03 

The authorized owner supplies access-review evidence for each in-scope system, records any gap and assigns a corrective action with a due date. 

04 

The designated authority reviews the risk, approves the revised control position and decides what can accurately be stated in the customer response. 

The result is a traceable chain from machine-raised observation to human examination, evidence and authorized decision. 

CONNECTED ISMS GOVERNANCE 

A static export may satisfy a document request, but the working governance value comes from links to the records that explain and test the control position. 

Connect control selection and treatment decisions to the live risk context. Explore risk management software. 

Link approved policies, standards, procedures and technical information without confusing documents with operating evidence. Explore document control. 

Use audits to examine whether controls operate as intended and route findings into accountable action. Explore the auditing platform. 

Connect role, competence, awareness, acknowledgments and assigned responsibility to the controls that depend on people. 

CLEAR PRODUCT BOUNDARIES 

INFORMED IMPLEMENTATION 

Use the licensed standards and competent advice applicable to your organization. Product content is informative and is not certification, legal advice or a substitute for the standard. 

Specifies requirements for establishing, implementing, maintaining and continually improving an ISMS. View the official ISO standard page. 

Provides guidance and good practice for information-security controls used within an ISMS. View the official ISO standard page. 

Provides a management-system framework for responsible development, provision or use of AI systems. View the official ISO standard page. 

It can assist analysis and drafting for human review, but Zebsoft’s approach is not to manufacture an approved SoA. Scope, risk treatment, applicability, exclusions, evidence, risk acceptance and approval require authorized human judgment. 

No blanket answer should be generated. The organization determines necessary controls through risk treatment and other requirements, uses Annex A as a reference and justifies exclusions in its SoA. 

No. It makes evidence accessible and traceable. Competent reviewers and auditors still evaluate authenticity, relevance, sufficiency, currency, operation and effectiveness. 

No. Zebsoft provides governance capability. Certification depends on the organization’s ISMS, implementation, evidence and independent assessment against applicable requirements.