Statement of Applicability Content

I thought the process for identifying applicable controls are done during the evaluation of risks & risk treatment processes. Could you give me an example?

Answer: According ISO 27001, clause 6.1.3 d), the Statement of Applicability is required to fulfil these purposes:
- list the necessary controls and their justification for inclusions; whether they are implemented or not, and
- the justification for exclusions of controls from Annex A

So, presenting the applicable controls is only part of the content you will find in a SoA compliant with ISO 27001. That's why the table presented has the "Not applicable controls" & the "Reason why N/A" options.

R egarding the identification of applicable controls, this is done during the risk treatment processes (the risk evaluation process will help you identify which risks require treatment).

As an example of a not applicable control, if your organization does not access, process or store information at teleworking sites, there is no reason to apply control A.6.2.2 (Teleworking), thus this controls is stated as Not Applicable in your SoA.

On the other hand, if your risk assessment identifies the loss of digital information as unacceptable, or if there is a contractual clause or top management decision demanding this risk to be treated, these reasons would be sufficient to justify the applicability of, let's say, control A.12.3.1 (Information backup).

This article will provide you further explanation about Statement of Applicability:
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/

These materials will also help you regarding Statement of Applicability:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/