“produce a Statement of Applicability that contains: the necessary controls (see 6.1.3 b) and c)); justification for their inclusion; whether the necessary controls are implemented or not; and the justification for excluding any of the Annex A controls.”ISO/IEC · ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection — Information security management systems — Requirements · 2022 · ISO/IEC 27001:2022, clauza 6.1.3 litera d) — conținutul obligatoriu al Declarației de aplicabilitate
Annex A is the safety net under your list of controls, not its source.
Almost every beginner reads the order of 6.1.3 backwards. It does not start from Annex A. First the treatment options are chosen, taking account of the assessment results; then all controls necessary to implement the chosen options are determined — the standard says plainly that they may be designed by the organization or identified from any source; only then is the resulting list compared with Annex A, as a cross-check that nothing necessary has been omitted. The outcome is recorded in the Statement of Applicability, the one document that ties risks to controls. It says four things about each control: that it is necessary, why it was included, whether it is implemented or not, and why any Annex A control was excluded. A necessary control that is not yet implemented is allowed to appear there; what is not allowed is silence. Finally, the treatment plan and the acceptance of residual risk are approved by the risk owners.
The previous passage showed the right order: risks, options, controls, then the cross-check with Annex A. The next step is understanding what happens when that comparison finds a difference. If a control from Annex A does not appear on your list, that is not automatically a mistake. It can be excluded, but only with a justification showing why your risks do not demand it. For example, a company with no physical office can explain why a control about office-area security has nothing to protect. What is not allowed is leaving the control out silently, with no written reason. The justification is not a formality for the auditor; it is your own thinking put on paper. And when the justification is missing, the auditor can no longer see where the system started from. But what happens to a control you found necessary, yet have not implemented yet?
A necessary control that is not yet implemented is allowed, under one condition: it must be recorded as such in the Statement of Applicability. The document thus becomes a map of the work still to be done. A control marked as necessary but not implemented shows a conscious decision, not neglect. For instance, a small firm knows it needs a strong password policy but will only write it next month; in the statement, its status is honest. An auditor sees the difference between a plan in progress and a shell game. What unbalances the system is silence: a control missing from the list without a reason, or one declared implemented when it is not. The statement must tell the truth about every line, even when the truth is uncomfortable. The question that remains is who signs off, in the end, on these decisions and on the risk left over after them.
Why it matters The Statement of Applicability is the first document asked for at stage 1 and the only one that shows whether the system really started from risk.