| File Reference : | F-IMS26 Statement of Applicability |
| Date File Updated | 02-10-26 |
| File Format | MS Word |
| No. of files | 2 |
| Category | IMS Registers | Tags: ISO 27001, Annex A, 6.1.3, statement of applicability |
Included in the alphaZ subscription
Every alphaZ document and toolkit, with updates as they are released. Everything you download is yours to keep.
This is the Statement of Applicability laid out control by control, with a column for why each control is included and a note of how it is implemented or why it does not apply.
This register template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Register number and title
- Information-classification
- Version
- Page number / total pages
Further guidance on ISO 27001 controls:
Download this register with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.
This file is included in the alphaZ subscription. This register is also included in the ISO 27001 toolkit and the integrated toolkits that include it, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help completing your Statement of Applicability and information security risk treatment, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Statement of Applicability Template
The Statement of Applicability is a Word template for ISO 27001:2022 that lists every Annex A control with space to record whether it applies, the reason it is included and an overview of how it is implemented, or the justification where it does not apply.
It is the document an ISO 27001 auditor works from when checking which controls you operate, and it records the outcome of your information security risk treatment.
What's Included in this Register
- Reviewed By and Date - a header row to record who reviewed the statement and when
- Inclusion reason codes - L Legislative, C Contractual, B Business Management and S Security Best Practice
- Organisational, People, Physical and Technological Controls - each ISO 27001:2022 Annex A control with its number, the control objective, the inclusion reason and comments on implementation or justification
- Additional Controls - a section for any controls you apply beyond Annex A
Two Versions Supplied
- F-IMS26 - laid out against the ISO 27001:2022 Annex A controls
- F-IMS26 2013 version - laid out against the ISO 27001:2013 Annex A controls, for reference when comparing with an earlier statement
Built for ISO 27001 Clause 6.1.3
- Records the decision on every Annex A control in one document
- Shows the reason for including each control as well as how it is implemented
- Records the justification for any control that does not apply
- Follows the same control listing as the ISO 27001:2022 Annex A correlation
Sample Data Versions for Subscribers
Completed examples are available with an alphaZ subscription including: a statement completed for a typical organisation, with the inclusion reason and an implementation note referencing the IMS1 manual for each control.
Included in the ISO 27001 Toolkit
This register is part of the ISO 27001 toolkit and the integrated toolkits that include it.
Keeping the Statement Current
Review the statement whenever your information security risk assessment or treatment plan changes, when controls are added or withdrawn, and before each audit. Update the reviewer and date in the header row each time, so it is clear which version is current.
Document Control
The footer carries the register number and title, issue, information classification and page numbering. The register can be listed with your other controlled documents on the F-IMS20 Document Register.
Works with the Information Security Risk Register
The decisions recorded in the statement follow from your information security risk work:
- ER15 Information Security Risks Register - the risks, scored, with the controls that apply
- F-Q14 Information Assets Matrix - the information assets the controls protect
- ISO 27001:2022 Annex A Correlation - an evidence note for each Annex A control that can be carried into the statement
- PP-8-100 Information Security Policy Procedure - the information security arrangements the controls describe
Would you rather we prepared it for you?
Our Information Security Risk and Treatment Plan service builds your information security risk assessment, treatment plan and Statement of Applicability around your real systems and data, checked by a consultant.
