ISO 27001 Statement of Applicability: How to Build One

Build an ISO 27001 Statement of Applicability from your risk assessment: the 93 Annex A controls, testable justifications, exclusions and upkeep.

Implementation kits

ISO 9001:2026 — Implementation and transition kits, packs and documents for quality management.
ISO 14001:2026 — Kits, packs and documents for environmental management.
ISO/IEC 27001:2022 — Kits, packs and documents for information security management.
DORA for financial entities — Kits, packs and documents for digital operational resilience.
DORA for ICT service providers — Kits, packs and documents for ICT third-party providers.
Integrated (9001 + 14001 + 27001) — One management system for three standards.
All kits, packs and documents

AI Governance & Algorithmic Quality — QMS discipline for AI systems, EU AI Act compliance, and ISO 42001 readiness.
Audit & Certification Readiness — Pre-audit preparation, surveillance audit support, NCR/CAR remediation.
Digital Governance & Systems — Digital QMS architecture and compliance technology integration.
Governance & Strategy — Find experts experienced in executive governance frameworks and board-ready compliance architectures.
Managed Compliance Programs — Ongoing compliance management and fractional quality leadership.
Project Recovery — Find experts experienced in distressed programs and rapid quality resets.
Quality & Operational Infrastructure — QMS development, ISO 9001 readiness, CAPA architecture, operational maturity modeling.
Regulatory Documentation — SOPs, work instructions, and regulatory submissions.
Risk & Regulatory Compliance — Multi-jurisdictional compliance, cross-border regulatory mapping, risk registers.
Supply Chain Compliance — Tier-N oversight, ethical labor compliance, EU CS3D due diligence.

Agentic AI and Human Oversight — Governance frameworks for autonomous AI in regulated environments.
Cost of Non-Compliance — The 2–4x cost variance between proactive and reactive compliance.
ESG as a Performance Metric — Moving ESG from reporting burden to competitive advantage.
Investor-Ready Operations — Building operational maturity that survives due diligence.
QMS Scalability — Designing quality systems that grow with the business.
View all insights →