4. Declaration of applicability

4.1 Normative appendix

Many standards include annexes. However, the originality of the 27001 standard lies in the fact that its Annex A is normative; in other words, to obtain the certificate, the candidate organization must meet all its requirements.

The documented response to the requirements of Appendix A must be formalized in the Statement of Applicability (SoA). This document describes the security objectives and appropriate measures applicable to the organization's information security management system.