Glossary
Statement of Applicability
A signed document recording, control by control, which apply to the system, which do not, and on what justification.
- SoA
- Declaración de Aplicabilidad
Under the Spanish ENS it is a literal obligation: Article 28(2) of Royal Decree 311/2022 requires the set of selected Annex II measures to be formalised in a document called the Declaración de Aplicabilidad, signed by the security officer. In ISO/IEC 27001 it plays an equivalent role for the Annex A controls.
Two things make it useful rather than a formality. The first is justifying the exclusions: a control marked not applicable with no written reason is a non-conformity waiting to happen. The second is how compensating measures are handled: where one control replaces another, the detailed mapping between them forms an integral part of the document itself, alongside the justification that it protects equally or better.
Without a signature and a date it is not a Statement of Applicability. It is a spreadsheet with good intentions.