After reading, you can build the statement from your risk treatment and write justifications that stand up in an audit.
Definition
Clause 6.1.3 d spells out its content: the necessary controls, the reason for including them, whether they are implemented, and the reason for excluding any Annex A control.
Risk treatment decides which controls are necessary. They can come from Annex A, from another framework, or from your own design.
Why it matters
It links the risks to the controls and shows which controls the certified system applies. Buyers often ask for a copy, and auditors use it to decide what to test.
How it works
Start from the risk treatment plan and list the controls chosen. Next, go through the 93 controls of Annex A to confirm that nothing necessary has been missed.
For each control, write the reason for including or excluding it, its implementation status, and a pointer to the document or record that shows it.
Have it approved, keep it under version control, and update it when risks or controls change.
A worked case
Control 7.10, storage media. A company with no removable media in scope excludes it, explaining that all data stays on its cloud platform and that device policy disables USB ports.
Control 8.13, information backup. It is included to treat the risk of data loss and is implemented, with a pointer to the backup procedure and the restore test of 12 May.
Good practices
- Trace each control back to a risk or an obligation.
- Point to the evidence. Copying it in makes the document unreadable and quickly out of date.
- Update the statement after every risk review, and check which version the certificate refers to.
Common mistakes
- Excluding a control because it is inconvenient. The reason has to come from your risks and your scope.
- Completing it before the risk assessment, which turns the logic of the standard upside down.
- Marking everything as implemented. A sample of three records is all it takes to disprove that.
- Writing “applicable” as a justification, which explains nothing.
Questions
- Must every Annex A control be included?
- No, but each must be addressed: included with a reason, or excluded with a reason.
- Is the Statement of Applicability public?
- It does not have to be. Companies often share it with buyers under a confidentiality agreement.
- Can controls from outside Annex A appear in it?
- Yes. Clause 6.1.3 allows controls from any source, and they are listed with the others.
- Who approves the Statement of Applicability?
- The standard requires the statement to be produced without naming an approver. Approval by the head of security and management is standard practice.
- How does it differ from a risk treatment plan?
- The plan says how risks will be treated, by whom and by when. The statement gives the position on each control.