4. Declaration of applicability

4.1 Normative appendix

Many standards include annexes. However, NF ISO/IEC 27001 is unique in that its Annex A is normative. This means that, to obtain the certificate, the candidate organization must meet all its requirements.

The documented response to the requirements of Appendix A must be formalized in the Statement of Applicability (SoA). This document describes the security objectives and appropriate measures applicable to the organization's information security management system.

4.2 Objectives...