Starting with SOA

Please note that before you start SoA you have some work to do (e.g., definition of the ISMS scope, Information security policy, risk assessment, and treatment methodology, etc.).

Considering that, we suggest you follow the order of folders and templates provided in the toolkit, so you minimize the complexity of your implementation and risks of rework.

Once you have completed the templates needed to support the SoA, you will have a better understanding of how to be filing it. In short, to start documenting the Statement of Applicability you need to perform a risk assessment and risk treatment, to identify the relevant risks and controls (from ISO 27001 Annex A or other sources) you will implement to treat them. Additionally, you need to identify legal requirements (e.g., laws, regulations, and contracts) which require the implementation of specific controls.

For further information, see:

• ISO 27001/ISO 27005 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
• The basics of risk assessment and treatment according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/
• Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/

Additionally, included in the toolkit you will buy you will have access to a video tutorial that will help you to fill in the Statement of Applicability.