The statement of applicability (SoA) is a mandatory ISO 27001 document justifying inclusion or exclusion of each Annex A control.
The SoA lists all 93 Annex A controls, indicates which are applicable, justifies exclusions and references implementation documents. It links risk assessment to implemented controls and is a focal point of every certification audit.
Technically yes, with valid justification. However, fundamental controls like security policy are very difficult to justify as not applicable.
Yes. It is one of the first documents the certification auditor reviews. It is the control audit roadmap.
Need an assessment in this area?