Template based on ISO/IEC 27001:2022
Statement of Applicability template for ISO 27001
All 93 Annex A controls in one list, each row with columns for applicability, justification, implementation status and evidence.
What the file contains
93 Annex A controls of ISO/IEC 27001:2022, each row with our own short title and a short explanation of what it is about. You fill in the columns for applicability, justification, implementation status, evidence and owner.
- A.5 Organizational controls 37 rows
- A.6 People controls 8 rows
- A.7 Physical controls 14 rows
- A.8 Technological controls 34 rows
Template version 1.0-80a8b81c · content as of 26 September 2026 · Excel (XLSX) 63 KB · PDF 76 KB
This template is not legal advice. It does not replace checking which requirements apply to your company and does not guarantee any audit or certification result. License CC BY 4.0
How to use the file
Decide what applies
Go through the list with your risk register: which control do you need because of a risk, a law or a contract?
Justify
Record why a control is included and why you exclude another. Clause 6.1.3 d of the standard asks for both.
Enter status and evidence
For each row the implementation status and where the evidence is. Then approve the statement and keep it with version and date.
The portal takes it from there
In Complass the Statement of Applicability is a catalog in the ISO 27001 project: applicability with justification, status, evidence and owner for each control. Risks point to the controls that treat them. You bring your spreadsheet in by import, and Excel stays available as an export.
Frequently asked questions
Are Statement of Applicability and SoA the same thing?
Yes. Both name the same document under ISO/IEC 27001:2022, clause 6.1.3 d. SoA is short for Statement of Applicability.
Do we have to implement all 93 controls?
No. You assess all 93 controls and implement the necessary ones. A control that your scope does not need is excluded with a justification.
Why does the template not contain the text of the standard?
Standards are protected by copyright. The template gives the number of each control, our own short title and our own explanation. The wording of your licensed copy is authoritative.
Our statement is still based on the 2013 edition. Does the template help?
Yes. The template follows the 2022 edition with 93 controls in four themes. Map your existing entries and check the newly added controls separately.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.