Why your SoA is NOT compliant!

As an auditor, I see the same mistake all the time. Here’s what the standard actually requires.

In my work as an information security auditor, I’ve seen a lot of Statements of Applicability (SoA). And honestly, most of them look the same. It doesn’t matter if it belongs to a multi-billion dollar corporation or a 10-person startup.

What I usually find is a big spreadsheet that includes a a direct copy-paste of ISO 27001’s Annex A, with three extra c…