statement-of-applicability-author

name

statement-of-applicability-author

description

Author the Statement of Applicability — the ISO-mandatory document tying every reference control to a per-control inclusion or exclusion justification through the 6.1.3 risk-treatment process; serves BOTH ISO 27001:2022 (Annex A controls) and ISO 42001:2023 (Annex A control objectives) from one procedure. Rows record include/exclude with a risk-or-obligation trace, implementation status mapped to the compliance-control-foundation catalog, and controlled-document metadata (version, named approver). Requires the licensed standard's actual Annex A table — never reconstructs entries or counts from memory or secondary sources. The largest net-new ISO artifact SOC 2 lacks. Use when asked to write or update an SoA, or when ISO 27001/42001 certification prep reaches the applicability document. Do NOT use for the whole management system (iso-27001-isms-architect / iso-42001-aims-architect), the control catalog (compliance-control-foundation), or cross-framework references (multi-framework-crosswalk).

Statement of Applicability Author

Purpose

Produce the Statement of Applicability (SoA) — the document ISO certification audits open first: for every control in the standard's Annex A, is it applicable to this organization, why (traced to the 6.1.3 risk-treatment process or an obligation), and what is its implementation state. One procedure serves both certifiable ISO standards — ISO 27001:2022 (Annex A "Information security controls reference", normative) and ISO 42001:2023 (Annex A "Reference control objectives and controls", normative) — because the SoA logic is identical even though the control lists differ. Implementation status maps to the compliance-control-foundation catalog so the SoA points at real mechanisms, not aspirations. The SoA is a controlled document: this skill authors proposals and diffs, with versioning and a named approver — it never silently rewrites an operating SoA.

Use When

• Use when: asked to write, draft, or update a Statement of Applicability for ISO 27001, ISO 42001, or both.
• Use when: ISO certification prep reaches the point of deciding which Annex A controls/objectives apply and justifying exclusions.