# SAMPLE: Statement of Applicability (extract)

> This is a sample document published by ISMS Copilot (ismscopilot.com/mcp) for trying the example prompts. Example Co is fictional. It is written with inconsistencies on purpose: compare it with the sample risk register extract.

**Company:** Example Co (fictional) | **Standard:** ISO/IEC 27001:2022 Annex A | **Version:** 1.2

| Control | Title | Applicable | Status | Justification |
|---|---|---|---|---|
| 5.19 | Information security in supplier relationships | Yes | Implemented | Supplier security review before onboarding. |
| 5.23 | Information security for use of cloud services | Yes | Implemented | AWS and Google Workspace configured to baseline. |
| 5.30 | ICT readiness for business continuity | Yes | Implemented | Continuity plan tested yearly. |
| 7.4 | Physical security monitoring | No | Excluded | Fully remote, no office. |
| 8.7 | Protection against malware | Yes | Implemented | Endpoint protection on all laptops. |
| 8.13 | Information backup | No | Excluded | Backups are handled by AWS. |
| 8.15 | Logging | Yes | Implemented | Central logging for production. |
| 8.24 | Use of cryptography | Yes | Implemented | Encryption in transit and at rest. |