OneClickComply
    Book a demo

    Statement of Applicability Generator

    A statement of applicability for ISO 27001, drafted and exported in one place

    A statement of applicability (SoA) is the ISO 27001 document that lists each Annex A control, says whether it applies to your organisation, and explains why. The OneClickComply Statement of Applicability Generator is for security and compliance leads preparing for ISO 27001:2022: it lists the Annex A controls, lets you set applicability and write justifications, drafts text with AI, and exports the result to DOCX.

    Book a demo
    Annex A
    ISO 27001:2022 control list
    Yes or no
    applicability with a justification
    DOCX
    export for review and audit
    THE PROBLEM

    What a statement of applicability is, and why it is hard to write

    Clause 6.1.3 d) of ISO 27001 asks you to produce a statement of applicability. In plain terms, it must contain the controls you have decided are necessary, a justification for including them, whether each one is implemented, and a justification for excluding any Annex A control you leave out. Annex A has 93 controls in four themes, so the document is long, and an auditor reads it first because it shows how your risk treatment became real decisions. A downloaded template lists the controls but says nothing about your organisation, and a spreadsheet drifts away from what you actually do. The result is boilerplate justifications that invite awkward questions.

    FEATURES

    How the Statement of Applicability Generator works

    ISO 27001:2022 Annex A in one view

    The generator appears as the Statement of Applicability tab on your ISO 27001 standard. It lists the Annex A controls grouped by the four themes: organisational, people, physical and technological.

    Applicable yes or no for every control

    Mark each control as applicable or not. Controls you exclude are shown dimmed, and the status choice is only offered for controls that apply, so the document stays consistent.

    Justification for inclusion or exclusion

    Each control has a justification field that changes with your decision, so you record why a control is included or why it is excluded. Some site-dependent physical controls, such as physical security perimeters and physical entry, start as excluded with a prompt to confirm the decision with your auditor.

    Implementation description and status

    For applicable controls you write an implementation description and set a status such as implemented or partially implemented. This answers the clause 6.1.3 d) question of whether each control is implemented.

    AI-drafted text you review

    Generate a justification and implementation description for a single control, or draft the remaining controls in bulk from the generate menu. Drafting is metered against your AI credits, and every draft is for you to review and edit before export.

    Export to DOCX

    Use the Export DOCX button to produce the statement of applicability as a Word document that you can review, version and hand to your auditor.

    See Statement of Applicability Generator working on your own setup.

    Book a demo
    BENEFITS

    What you can show your auditor

    A decision and a justification recorded against every Annex A control, in one place

    Justifications written from your own control set instead of generic template wording

    A reviewable first draft you can edit, instead of a blank spreadsheet

    Exclusions kept separate from applicable controls, with the reason recorded

    A Word document your auditor can read and comment on

    FAQ

    Statement of Applicability Generator: common questions

    A statement of applicability is the document that lists every Annex A control, states whether it applies to your organisation, and gives the reason. It is required by clause 6.1.3 d) and is one of the first things a certification auditor asks to see.

    It requires a statement of applicability that contains the necessary controls and the justification for including them, whether they are implemented, and the justification for excluding any Annex A control. The OneClickComply generator has fields for each of these.

    Work through each Annex A control, decide whether it applies after your risk assessment, and record a justification and how it is implemented. The generator gives you the control list, the applicability toggle, the justification fields and an AI draft to start from.

    It can draft the justification and implementation text for one control or for all remaining controls, and the draft is flagged for your review. It does not replace your risk assessment, so you must check that each decision reflects your organisation.

    AI drafting is metered against your AI credit balance. Editing applicability and justifications by hand and exporting to DOCX do not rely on AI drafting.

    No. The generator produces a statement of applicability for ISO 27001 only, because that is the standard that requires one. Other frameworks are handled through their own control lists in the platform.

    Frameworks Statement of Applicability Generator supports

    Read what each framework asks for and how OneClickComply covers it.

    See Statement of Applicability Generator on your own stack

    Book a 30-minute demo and see how Statement of Applicability Generator works with the tools and frameworks you already have.

    Book a demo See pricing