F-IMS26 Statement of Applicability
| File Reference : | F-IMS26 Statement of Applicability |
This is the Statement of Applicability laid out control by control, with a column for why each control is included and a note of how it is implemented or why it does not apply.
This register template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Register number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested register templates. No junk, jargon or unnecessary content. Simple and usable register templates
developed over 25 years through practical use in the real world.
Further guidance on ISO 27001 controls:
Download this register with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This register is also included in the ISO 27001 toolkit and the integrated toolkits that include it, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help completing your Statement of Applicability and information security risk treatment, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Statement of Applicability Template
The Statement of Applicability is a Word template for ISO 27001:2022 that lists every Annex A control with space to record whether it applies, the reason it is included and an overview of how it is implemented, or the justification where it does not apply.
It is the document an ISO 27001 auditor works from when checking which controls you operate, and it records the outcome of your information security risk treatment.
What's Included in this Register
- Reviewed By and Date - a header row to record who reviewed the statement and when
- Inclusion reason codes - L Legislative, C Contractual, B Business Management and S Security Best Practice
- Organisational, People, Physical and Technological Controls - each ISO 27001:2022 Annex A control with its number, the control objective, the inclusion reason and comments on implementation or justification
- Additional Controls - a section for any controls you apply beyond Annex A
Two Versions Supplied
- F-IMS26 - laid out against the ISO 27001:2022 Annex A controls
- F-IMS26 2013 version - laid out against the ISO 27001:2013 Annex A controls, for reference when comparing with an earlier statement
Built for ISO 27001 Clause 6.1.3
- Records the decision on every Annex A control in one document
- Shows the reason for including each control as well as how it is implemented
- Records the justification for any control that does not apply
- Follows the same control listing as the ISO 27001:2022 Annex A correlation
Sample Data Versions for Subscribers
Completed examples are available with an alphaZ subscription including: a statement completed for a typical organisation, with the inclusion reason and an implementation note referencing the IMS1 manual for each control.
Included in the ISO 27001 Toolkit
This register is part of the ISO 27001 toolkit and the integrated toolkits that include it.
Keeping the Statement Current
Review the statement whenever your information security risk assessment or treatment plan changes, when controls are added or withdrawn, and before each audit. Update the reviewer and date in the header row each time, so it is clear which version is current.
Document Control
The footer carries the register number and title, issue, information classification and page numbering. The register can be listed with your other controlled documents on the F-IMS20 Document Register.
Works with the Information Security Risk Register
The decisions recorded in the statement follow from your information security risk work:
Would you rather we prepared it for you?
Our Information Security Risk and Treatment Plan service builds your information security risk assessment, treatment plan and Statement of Applicability around your real systems and data, checked by a consultant.
Information Security Risk and Treatment Plan