ISO 27001 SoA Builder
Statement of Applicability across the 93 ISO/IEC 27001:2022 Annex A controls. Record each control's applicability, justification, implementation status and how it is addressed, then export.
What this builds
A working Statement of Applicability (SoA) — the central ISMS document required by ISO/IEC 27001 clause 6.1.3 d). For each of the 93 Annex A:2022 controls you record whether it is applicable, the justification for its inclusion or exclusion, the implementation status, and a reference to the policy, procedure or evidence that addresses it. Owner and risk-reference columns help you trace each decision back to a risk owner and your risk assessment.
Scope & honesty note: this tool produces a working document to help you draft and track your SoA. It is not a certification, not a conformity assessment, and not legal or audit advice. Certification is granted only by an accredited certification body after an audit. The control IDs and short titles are the public Annex A reference numbering; the full normative control text is in the copyrighted ISO/IEC 27001:2022 and ISO/IEC 27002:2022 standards, which you should obtain from ISO or a national standards body.
Cross-link with the Control Mapper (CSF / ISO / DORA) and the NIST CSF Profile Builder.