--- title: "ISO/IEC 27001 SoA Exclusions FAQ" canonical_url: "https://www.sorena.io/artifacts/global/iso-27001/faq/soa-exclusions" source_url: "https://www.sorena.io/artifacts/global/iso-27001/faq/soa-exclusions" author: "Sorena AI" description: "How should teams justify Statement of Applicability exclusions under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references." published_at: "2026-05-09" updated_at: "2026-05-09" keywords: - "ISO/IEC 27001 SoA Exclusions FAQ" - "SoA Exclusions ISO/IEC 27001" - "ISO/IEC 27001 evidence" - "ISO/IEC 27001 implementation" - "ISO/IEC 27001" - "ISO/IEC 27001:2022 Information Security Management System" - "ISO/IEC 27001 FAQ: SoA Exclusions" - "FAQ" - "global compliance" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # ISO/IEC 27001 SoA Exclusions FAQ How should teams justify Statement of Applicability exclusions under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. *FAQ* *Global* *ISO/IEC 27001* ## ISO/IEC 27001 FAQ SoA Exclusions How should teams justify Statement of Applicability exclusions under ISO/IEC 27001? This guide walks through topic-specific decisions, owners, evidence requirements, review gates, and traceability steps so teams can implement repeatable ISO/IEC 27001 outcomes. This ISO/IEC 27001 FAQ answers SoA Exclusions in standalone terms: what decision is required, who owns it, what evidence proves it, and when it should be reviewed. ## How should teams justify Statement of Applicability exclusions under ISO/IEC 27001? Start with the operational decision: define what SoA Exclusions means in your ISO/IEC 27001 scope, who owns it, and what record proves the decision is current. For ISMS work, keep the traceability chain visible: scope, risk, treatment choice, SoA entry, control owner, evidence sample, exception, corrective action, and management review decision. This keeps the answer useful in audits, customer reviews, incidents, supplier reviews, and management review. - Name the accountable owner and reviewer for SoA Exclusions. - Record the scope, assumptions, decision, approval date, evidence location, exception status, and next review trigger. - Escalate when SoA Exclusions changes risk acceptance, service commitments, customer promises, regulatory duties, or certification evidence. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. ## What evidence should prove SoA Exclusions is current under ISO/IEC 27001? The evidence should show the process operating. For this artifact, the strongest record usually includes ISMS scope, risk assessment, treatment plan, Statement of Applicability, Annex A evidence, internal audits, corrective actions, and management review records. Avoid evidence that only repeats a requirement. A reviewer should be able to see the actual owner, date, system, supplier, security-critical system, service, incident, risk, or control sample behind the answer. - Use source records from the system of work, not screenshots created only for audit day. - Keep exceptions visible as risk acceptance, corrective action, or management-review input. - Update linked registers when the answer changes an owner, risk, control, service, supplier, or review date. Sources for this answer: - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. - [ISO/IEC 27005:2022 standard page](https://www.iso.org/standard/80585.html?ref=sorena.io) - This source supports risk treatment and monitoring context that informs control decisions and residual risk handling. ## Who should approve SoA Exclusions decisions under ISO/IEC 27001? The person who can fund, operate, and correct the process should own the decision; governance should review consistency and exceptions. For high-impact changes, approval should include the teams affected by the evidence: security, privacy, resilience, supplier management, security governance, legal, risk, or business service owners as relevant. - Use a named owner, named backup, and named escalation forum. - Separate preparation work from risk acceptance and final approval. - Keep approval records with the evidence rather than in disconnected email threads. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. ## When should SoA Exclusions be reviewed under ISO/IEC 27001? Review it at planned intervals and whenever the underlying scope, service, supplier, control, risk, security-critical system, personal data flow, incident process, or customer commitment changes. A stale record is worse than a short record. If the facts change, update the evidence and mark what changed so the next reviewer can trust the page. - Set a planned review date and a change-trigger rule. - Use findings to update controls, procedures, contracts, risk registers, or training. - Carry unresolved items into management review or risk acceptance. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. ## Primary sources - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations. - Quote: "Information security management systems - Requirements" - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. - Quote: "Information security controls" - [ISO/IEC 27005:2022 standard page](https://www.iso.org/standard/80585.html?ref=sorena.io) - This source supports risk treatment and monitoring context that informs control decisions and residual risk handling. - Quote: "Guidance on managing information security risks" ## Topic Guides - [ISO/IEC 27001 Annex A Control Evidence Guide](/artifacts/global/iso-27001/annex-a-2022-control-evidence.md): Build useful ISO/IEC 27001:2022 Annex A control evidence: selected controls, SoA rationale, owners, implementation proof, effectiveness checks, audit records, and improvement actions. - [ISO/IEC 27001 Annex A Control Ownership FAQ](/artifacts/global/iso-27001/faq/annex-a-control-ownership.md): How should teams assign Annex A Control Ownership under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27001 Audit Readiness Guide](/artifacts/global/iso-27001/audit-readiness.md): Prepare ISO/IEC 27001 audit evidence across ISMS scope, risk assessment, risk treatment, Statement of Applicability, Annex A controls, internal audit, management review, and corrective actions. - [ISO/IEC 27001 Certification Body Evidence FAQ](/artifacts/global/iso-27001/faq/certification-body-evidence.md): How should teams handle Certification Body Evidence under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27001 Certification Stage Workflow](/artifacts/global/iso-27001/certification-stage-workflow.md): A practical ISO/IEC 27001 certification workflow for scope readiness, Stage 1 document review, Stage 2 evidence, nonconformities, corrective action, certification decision, surveillance, and recertification. - [ISO/IEC 27001 Compliance Guide: ISMS Evidence](/artifacts/global/iso-27001/compliance.md): Build ISO/IEC 27001 compliance around ISMS scope, risk assessment, risk treatment, Statement of Applicability, Annex A controls, audits, management review, and corrective action evidence. - [ISO/IEC 27001 FAQ: ISMS Scope, Risk and SoA](/artifacts/global/iso-27001/faq.md): Practical ISO/IEC 27001 FAQ covering ISMS scope, risk assessment, risk treatment, Statement of Applicability, Annex A controls, certification evidence, audits, management review, and surveillance readiness. - [ISO/IEC 27001 Implementation Roadmap Guide](/artifacts/global/iso-27001/implementation-roadmap.md): ISO/IEC 27001 Implementation Roadmap for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 Internal Audit and Management Review Guide](/artifacts/global/iso-27001/internal-audit-and-management-review.md): ISO/IEC 27001 Internal Audit and Management Review for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 Internal Audit FAQ](/artifacts/global/iso-27001/faq/internal-audit.md): How should teams run ISO/IEC 27001 internal audits: who should own each step, what evidence is expected, and how findings are resolved. - [ISO/IEC 27001 Management Review FAQ](/artifacts/global/iso-27001/faq/management-review.md): How should teams handle Management Review under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27001 Requirements Guide](/artifacts/global/iso-27001/requirements.md): ISO/IEC 27001 Requirements for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 Risk Acceptance FAQ](/artifacts/global/iso-27001/faq/risk-acceptance.md): How should teams handle Risk Acceptance under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27001 Risk Treatment and Residual Risk Guide](/artifacts/global/iso-27001/risk-treatment-and-residual-risk.md): ISO/IEC 27001 Risk Treatment and Residual Risk for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 Risk Treatment Register Workflow](/artifacts/global/iso-27001/risk-treatment-register-workflow.md): ISO/IEC 27001 Risk Treatment Register Workflow for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 SoA: workflow for gathering and documenting control evidence](/artifacts/global/iso-27001/statement-of-applicability-evidence-workflow.md): ISO/IEC 27001 Statement of Applicability Evidence Workflow for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 Statement of Applicability template: Annex A control selection and justification](/artifacts/global/iso-27001/statement-of-applicability-template.md): ISO/IEC 27001 Statement of Applicability Template for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 Surveillance Audits FAQ](/artifacts/global/iso-27001/faq/surveillance-audits.md): How should teams handle Surveillance Audits under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27001 vs NIS2 Comparison](/artifacts/global/iso-27001/iso-27001-vs-nis2.md): ISO/IEC 27001 vs NIS2 for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 vs NIST CSF 2.0 Comparison](/artifacts/global/iso-27001/iso-27001-vs-nist-csf-2-0.md): ISO/IEC 27001 vs NIST CSF 2.0 for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 vs SOC 2 Comparison](/artifacts/global/iso-27001/iso-27001-vs-soc-2.md): ISO/IEC 27001 vs SOC 2 for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. *Recommended next step* *Placement: after implementation guidance* ## Operationalize ISO/IEC 27001 FAQ: SoA Exclusions Use this ISO/IEC 27001 guide as the starting point for a tracked workflow: assign owners, request evidence, record decisions, and keep review dates visible instead of leaving the guidance in a document. - [Open Assessment Autopilot for ISO/IEC 27001](/solutions/assessment.md): Convert ISO/IEC 27001 FAQ: SoA Exclusions into accountable tasks, evidence requests, and review checkpoints. - [Talk through implementation](/contact.md): Review your current scope, evidence gaps, and next implementation steps. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/global/iso-27001/faq/soa-exclusions