ISO 27001 SoA and SOC 2 System Description
Your Statement of Applicability, drafted from your own controls
A Statement of Applicability (SoA) is the ISO 27001 document that lists every Annex A control, says whether it applies to you and explains why. OneClickComply drafts your SoA with AI inside the ISO 27001 standard view, grounded in your own controls and evidence, and does the same for your SOC 2 System Description.
Book my walkthrough- AI-drafted SoA inside the ISO 27001 standard view, with applicability, justification and implementation for each control
- A SOC 2 System Description generator, drafted section by section
- Cyber Essentials questionnaire support, including the version assessed from 27 April 2026
- Answers carried over from your previous Cyber Essentials questionnaire, flagged for review
A UK-built compliance platform with an in-house audit team
Trusted by hundreds of customers
93
Annex A controls in the ISO 27001:2022 SoA
8 sections
in the SOC 2 System Description generator
Your evidence
behind every draft, not a generic template
The problem
Why the SoA takes so long to write
93 decisions, made by hand
ISO 27001:2022 Annex A has 93 controls, and the SoA needs a decision and a justification for every one. In a spreadsheet that takes days and drifts from what you actually do.
Templates that know nothing about you
A downloaded SoA template lists the controls but not your environment, so the justifications read as boilerplate to an auditor.
A SOC 2 description from a blank page
The SOC 2 System Description has to cover your services, boundaries, infrastructure, people and controls. Starting from nothing holds up the audit.
How it works
From controls to a reviewed draft
- 01
Adopt the standard
Adopt ISO 27001 or SOC 2 in OneClickComply and its tasks are created for you, linked to your controls.
- 02
Build up your evidence
Connect your tools and complete tasks, so each control has real evidence behind it.
- 03
Draft with AI
Generate the SoA inside the ISO 27001 standard view, or the System Description section by section. Each draft is grounded in your own controls and evidence.
- 04
Review and export
Check every applicability decision and justification, edit what you need, then export the finished document for your auditor.
Statement of Applicability FAQs
What is a Statement of Applicability?
A Statement of Applicability (SoA) is a required ISO 27001 document that lists every Annex A control, states whether it applies to your organisation and justifies each decision. It also records how each applicable control is implemented, and auditors use it as a map of your ISMS.
How does the SoA generator work?
Inside the ISO 27001 standard view, AI drafts the applicability, justification and implementation for each Annex A control. Drafts are grounded in your own controls and evidence, and you review and edit every entry before exporting.
Is an AI-drafted SoA acceptable to auditors?
Auditors assess whether the SoA is accurate and justified, not how it was written. Because each draft is based on your own controls and evidence and is reviewed by your team, it reflects what you actually do.
What is a SOC 2 System Description?
The SOC 2 System Description is the section of a SOC 2 report in which you describe the system being examined: your services, boundaries, infrastructure, people, controls and the subservice organisations you rely on. OneClickComply drafts it section by section, filling infrastructure from your connections and assets, control activities from your SOC 2 controls and subservice organisations from your vendors.
Does it support the April 2026 Cyber Essentials questions?
Yes. OneClickComply supports the Cyber Essentials questionnaire assessed from 27 April 2026. Answers from your previous questionnaire are carried over and flagged for review, so you only rewrite what has changed.
Learn more
- ISO 27001Automate ISO 27001:2022 from Annex A to audit.
- SOC 2Automate SOC 2 evidence and monitoring.
- Cyber EssentialsThe UK government-backed security baseline.
- How to complete an ISO 27001 SoAA step-by-step guide to the Statement of Applicability.
- Cross-framework control mappingOne control set mapped across 240+ standards.
- ISO 27002:2022The guidance behind each Annex A control.
Stop writing the SoA from scratch.
See a Statement of Applicability drafted from controls and evidence.
- AI-drafted SoA inside the ISO 27001 standard view, with applicability, justification and implementation for each control
- A SOC 2 System Description generator, drafted section by section
- Cyber Essentials questionnaire support, including the version assessed from 27 April 2026