Lesson 2.58: ISO/IEC 27001 and the Statement of Applicability
ISO/IEC 27001 is the international standard organisations get certified against. Its 2022 edition has 93 Annex A controls in four themes: organisational (37), people (8), physical (14) and technological (34). The key document is the Statement of Applicability (SoA): for every control, is it applicable, is it implemented, and why. Auditors read it first. In the lab you check an excerpt of Northwind's SoA: the controls per theme, applicable controls not yet in place, exclusions without a justification, and the status of controls that were new in 2022.
15 min
You will learn to
- Explain ISO/IEC 27001 certification and Annex A
- Read a Statement of Applicability
- Find applicable controls not implemented
- Spot exclusions without justification
- Know some controls new in the 2022 edition
Key terms
- ISMS
- Information security management system: the policies, processes and controls an organisation runs and improves.
- Annex A
- The reference list of 93 controls (2022) in four themes.
- Statement of Applicability (SoA)
- For every Annex A control: applicable or not, implemented or not, and why.
- Nonconformity
- An audit finding that a requirement isn't met.
- Risk treatment plan
- How and when each risk will be treated, linked to the controls.
← Security controls: preventive, detective, corrective · All lessons · Security dashboards: garbage in, garbage out →