Produce a defensible ISO 27001 Statement of Applicability
The document auditors open first is the one that drifts
The Statement of Applicability is the document an ISO 27001 auditor opens first. It has to state which Annex A controls apply, which don't, and why — and it has to match what your organization actually does today, not what it did at your last certification.
Most teams maintain it in a spreadsheet that drifts the moment controls, scope, or standards change. Conformity percentages get tallied by hand, and applicability decisions lose their justification.
So the document meant to evidence deliberate control selection becomes the thing you scramble to reconstruct the week before the audit.
What you can do with the Statement of Applicability
- Work from a dedicated SoA view mapped to ISO 27001, not a generic control list.
- Mark each control applicable or not applicable per organization and per category.
- Evaluate applicability conditions across built-in and external standards in one place.
- See per-category applicable-control totals and conformity percentages calculated for you.
- Report against the ISO 27001 SoA control set, including the 2013 set, without manual mapping.
What it delivers to your program
- Walk into the audit with the SoA already done — applicability and conformity are tracked live, not rebuilt the week before.
- Defend every applicability decision — status recorded per control and category gives "why is this excluded?" a ready answer.
- Stop hand-counting conformity — per-category percentages are computed for you, removing a recurring spreadsheet error.
- Keep one SoA across multiple standards so internal and external frameworks stay tied to the same control inventory.
Built for compliance
These mappings show how the feature supports your obligations — they do not guarantee or constitute compliance.
| What DPMS does | Maps to | How |
|---|---|---|
| Designates applicable vs. not-applicable controls | ISO 27001 (Statement of Applicability) | Per-control, per-category applicability status in a dedicated SoA view |
| Supports the ISO 27001 SoA control set | ISO 27001 Annex A | Built-in mapping to the control set, including the SoA 2013 set |
| Evaluates applicability across standards | ISO 27001 | Conditions assessed for both local and external standards |
| Reports conformity per category | ISO 27001 | Automatic applicable-control totals and conformity-percentage calculation |
Why Priverion
Unlike general-purpose GRC tools that hold the SoA as a standalone register, Priverion treats it as a first-class view tied to ISO 27001 — applicability and conformity percentages are computed per category from your live control data, not entered by hand.
Because the SoA sits inside one unified privacy and InfoSec platform, the controls you assess feed the same inventory your risk and compliance work already uses. The document an auditor reviews reflects the state of your controls today, without re-keying.
Questions CISOs ask before a demo
Does this produce an ISO 27001 Statement of Applicability specifically?
Can I mark controls not applicable and keep that decision documented?
Are conformity percentages calculated automatically?
Does it work with standards beyond the built-in ISO 27001 set?
Explore related capabilities
Ready to produce an audit-ready SoA?
