Back to ISO
The module
Statement of Applicability
For 27001 and 42001 the statement is built from the control register. Every control, included or excluded, with a justification.
Record
The statement
The standard
ISO/IEC 27001
Where it is used
From the control register
What it does
- Every control is listed. Inclusion or exclusion is a decision, with a reason.
- Implementation status sits on the control.
- The statement is generated from that register. It is not a free-written document that can drift.
On the record
- Change a control, and the statement changes with it.
- A control with no justification stays open.
- 45001, 9001, and the others do not pretend to need one.
The standard
ISO/IEC 27001
The Statement of Applicability is required.
ISO/IEC 42001
The Statement of Applicability is required, with the AI system impact assessment beside it.
Also in The module
All- Document controlRequired documents for each standard, written in the app. Version history, approval, and the review date.
- Clause complianceEvery clause for the standards you hold, with a status, an owner, and the evidence linked to it.
- Internal audits and nonconformitiesAudits against the clause set. A finding becomes a nonconformity with a corrective action.
- Management review and objectivesThe review inputs the standard actually asks for. Objectives with a baseline, a target, and a measurement series.
- AI gap assessmentOn request, a draft internal audit from the records you already hold. A named person reviews, amends, and signs.