ISMS CopilotGenerating an ISO 27001 Statement of Applicability
Your AI reads the SoA and the treatment rows you already have and lists the differences. ISMS Copilot drafts the justifications and says which differences matter. You sign. The SoA stays yours.
Justifying a Statement of Applicability you already keep
Clause 6.1.3 d) of ISO 27001:2022 requires an SoA that lists the necessary controls, justifies their inclusion, states their implementation status, and justifies the exclusion of any Annex A controls. Auditors challenge SoAs where exclusions are unjustified or applicability is asserted without a link to the risk treatment plan. ISMS Copilot starts from the 93 Annex A:2022 controls across the four themes, ties each applicability decision to the risk assessment and treatment outputs, and drafts inclusion and exclusion justifications in language that references the threat, the treatment option chosen and the residual risk owner. Your AI reads the SoA and the treatment rows from your files and lists the differences between them: a control excluded in the SoA but used in a treatment, a control with no evidence pointer, a review date that has passed. ISMS Copilot drafts the justifications and says which of those differences an auditor would raise and how to fix them. You file the result yourself; control selection and risk acceptance remain management decisions, not automated ones.
Explore the ISO 27001 Copilot →Free SoA generator and Annex A finder
Want a first pass before the ISMS owner refines it? The free ISO 27001 SoA Generator produces a starter Statement of Applicability over all 93 Annex A:2022 controls (applicable, excluded or partial with justification) from the same control dataset — a draft to react to, not an approved SoA.
Open the free ISO 27001 SoA Generator →Frequently Asked Questions
What does clause 6.1.3 d) require in an SoA?
It requires the necessary controls with justification for inclusion, their implementation status, and justification for excluding any Annex A controls. ISMS Copilot structures the SoA so each of these elements is explicit and traceable to the risk treatment plan.
How are exclusions justified?
Each excluded Annex A:2022 control gets a documented rationale tied to scope or the risk assessment, for example a control not relevant because the organization does not perform that activity. Unjustified exclusions are the most common SoA audit finding, so the Copilot prompts for a defensible reason.
Does our SoA get uploaded?
No. Your AI reads the SoA and the risk treatment rows and sends only the lines the question needs, which become part of the conversation in your account. ISMS Copilot drafts justifications and judges the differences your AI found. You file the SoA yourself, in the sheet or GRC platform you already keep it in.
Does it decide which controls apply?
No. The Copilot drafts justifications and tracks status from your risk assessment, but control selection and risk acceptance are management decisions. The ISMS owner reviews and approves the SoA before it is used as audit evidence.
Ready to do compliance work faster?
Built for speed, accuracy, and audit-ready output.