Does the SoA need a justification for every excluded control?

Priya (ISMS lead)10 Sept 202614 votes

Our consultant says we only need to list included controls. Our certification body's checklist asks for exclusion justifications. Which is right under the 2022 version?

1 answer

QULDEX Editorial TeamStaffAccepted answer11 votes11 Sept 2026

Clause 6.1.3 d) requires the Statement of Applicability to contain the necessary controls, the justification for their inclusion, whether they are implemented, and the justification for excluding any Annex A control. So both inclusions and exclusions need a justification.

ISO 27001 nonconformities: major vs minor, with worked examples
An audit evidence naming convention that survives three audits
ISO 27001:2022 transition: what changed and what auditors now check

1 answer

Related articles