FAQGlobalISO/IEC 27001

ISO/IEC 27001 FAQ SoA Exclusions

How should teams justify Statement of Applicability exclusions under ISO/IEC 27001?

This guide walks through topic-specific decisions, owners, evidence requirements, review gates, and traceability steps so teams can implement repeatable ISO/IEC 27001 outcomes.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
May 9, 2026
Questions
4

Structured answer sets in this page tree.

Primary sources
3

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated May 9, 2026
Overview

This ISO/IEC 27001 FAQ answers SoA Exclusions in standalone terms: what decision is required, who owns it, what evidence proves it, and when it should be reviewed.

Search this module

Find a question or answer quickly

4 of 4 questions
Question 1

How should teams justify Statement of Applicability exclusions under ISO/IEC 27001?

Start with the operational decision: define what SoA Exclusions means in your ISO/IEC 27001 scope, who owns it, and what record proves the decision is current.

For ISMS work, keep the traceability chain visible: scope, risk, treatment choice, SoA entry, control owner, evidence sample, exception, corrective action, and management review decision. This keeps the answer useful in audits, customer reviews, incidents, supplier reviews, and management review.

  • Name the accountable owner and reviewer for SoA Exclusions.
  • Record the scope, assumptions, decision, approval date, evidence location, exception status, and next review trigger.
  • Escalate when SoA Exclusions changes risk acceptance, service commitments, customer promises, regulatory duties, or certification evidence.
Citations
ISO/IEC 27001:2022 standard page

Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations.

Question 2

What evidence should prove SoA Exclusions is current under ISO/IEC 27001?

The evidence should show the process operating. For this artifact, the strongest record usually includes ISMS scope, risk assessment, treatment plan, Statement of Applicability, Annex A evidence, internal audits, corrective actions, and management review records.

Avoid evidence that only repeats a requirement. A reviewer should be able to see the actual owner, date, system, supplier, security-critical system, service, incident, risk, or control sample behind the answer.

  • Use source records from the system of work, not screenshots created only for audit day.
  • Keep exceptions visible as risk acceptance, corrective action, or management-review input.
  • Update linked registers when the answer changes an owner, risk, control, service, supplier, or review date.
Citations
Recommended next step

Operationalize ISO/IEC 27001 FAQ: SoA Exclusions

Use this ISO/IEC 27001 guide as the starting point for a tracked workflow: assign owners, request evidence, record decisions, and keep review dates visible instead of leaving the guidance in a document.

Assessment workflow
Open Assessment Autopilot for ISO/IEC 27001

Convert ISO/IEC 27001 FAQ: SoA Exclusions into accountable tasks, evidence requests, and review checkpoints.

Explore next step
Talk to Sorena
Talk through implementation

Review your current scope, evidence gaps, and next implementation steps.

Explore next step
Question 3

Who should approve SoA Exclusions decisions under ISO/IEC 27001?

The person who can fund, operate, and correct the process should own the decision; governance should review consistency and exceptions.

For high-impact changes, approval should include the teams affected by the evidence: security, privacy, resilience, supplier management, security governance, legal, risk, or business service owners as relevant.

  • Use a named owner, named backup, and named escalation forum.
  • Separate preparation work from risk acceptance and final approval.
  • Keep approval records with the evidence rather than in disconnected email threads.
Citations
ISO/IEC 27001:2022 standard page

Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations.

Question 4

When should SoA Exclusions be reviewed under ISO/IEC 27001?

Review it at planned intervals and whenever the underlying scope, service, supplier, control, risk, security-critical system, personal data flow, incident process, or customer commitment changes.

A stale record is worse than a short record. If the facts change, update the evidence and mark what changed so the next reviewer can trust the page.

  • Set a planned review date and a change-trigger rule.
  • Use findings to update controls, procedures, contracts, risk registers, or training.
  • Carry unresolved items into management review or risk acceptance.
Citations
ISO/IEC 27001:2022 standard page

Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations.

Primary sources

References and citations

ISO/IEC 27001:2022 standard page
iso.org
Referenced sections
  • Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations.
"Information security management systems - Requirements"
ISO/IEC 27002:2022 standard page
iso.org
Referenced sections
  • This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance.
"Information security controls"
ISO/IEC 27005:2022 standard page
iso.org
Referenced sections
  • This source supports risk treatment and monitoring context that informs control decisions and residual risk handling.
"Guidance on managing information security risks"
Related guides

Explore more topics

ISO/IEC 27001 Annex A Control Evidence Guide
Build useful ISO/IEC 27001:2022 Annex A control evidence: selected controls, SoA rationale, owners, implementation proof, effectiveness checks, audit records, and improvement actions.
ISO/IEC 27001 Annex A Control Ownership FAQ
How should teams assign Annex A Control Ownership under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references.
ISO/IEC 27001 Audit Readiness Guide
Prepare ISO/IEC 27001 audit evidence across ISMS scope, risk assessment, risk treatment, Statement of Applicability, Annex A controls, internal audit, management review, and corrective actions.
ISO/IEC 27001 Certification Body Evidence FAQ
How should teams handle Certification Body Evidence under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references.
ISO/IEC 27001 Certification Stage Workflow
A practical ISO/IEC 27001 certification workflow for scope readiness, Stage 1 document review, Stage 2 evidence, nonconformities, corrective action, certification decision, surveillance, and recertification.
ISO/IEC 27001 Compliance Guide: ISMS Evidence
Build ISO/IEC 27001 compliance around ISMS scope, risk assessment, risk treatment, Statement of Applicability, Annex A controls, audits, management review, and corrective action evidence.
ISO/IEC 27001 FAQ: ISMS Scope, Risk and SoA
Practical ISO/IEC 27001 FAQ covering ISMS scope, risk assessment, risk treatment, Statement of Applicability, Annex A controls, certification evidence, audits, management review, and surveillance readiness.
ISO/IEC 27001 Implementation Roadmap Guide
ISO/IEC 27001 Implementation Roadmap for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions.
ISO/IEC 27001 Internal Audit and Management Review Guide
ISO/IEC 27001 Internal Audit and Management Review for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions.
ISO/IEC 27001 Internal Audit FAQ
How should teams run ISO/IEC 27001 internal audits: who should own each step, what evidence is expected, and how findings are resolved.
ISO/IEC 27001 Management Review FAQ
How should teams handle Management Review under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references.
ISO/IEC 27001 Requirements Guide
ISO/IEC 27001 Requirements for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions.
ISO/IEC 27001 Risk Acceptance FAQ
How should teams handle Risk Acceptance under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references.
ISO/IEC 27001 Risk Treatment and Residual Risk Guide
ISO/IEC 27001 Risk Treatment and Residual Risk for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions.
ISO/IEC 27001 Risk Treatment Register Workflow
ISO/IEC 27001 Risk Treatment Register Workflow for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions.
ISO/IEC 27001 SoA: workflow for gathering and documenting control evidence
ISO/IEC 27001 Statement of Applicability Evidence Workflow for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions.
ISO/IEC 27001 Statement of Applicability template: Annex A control selection and justification
ISO/IEC 27001 Statement of Applicability Template for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions.
ISO/IEC 27001 Surveillance Audits FAQ
How should teams handle Surveillance Audits under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references.
ISO/IEC 27001 vs NIS2 Comparison
ISO/IEC 27001 vs NIS2 for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions.
ISO/IEC 27001 vs NIST CSF 2.0 Comparison
ISO/IEC 27001 vs NIST CSF 2.0 for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions.
ISO/IEC 27001 vs SOC 2 Comparison
ISO/IEC 27001 vs SOC 2 for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions.