Declaration of applicability
Information security, cybersecurity, and protection of privacy data - ISO/IEC 27001 : 2022

Many standards include annexes. However, NF ISO/IEC 27001 is unique in that its Annex A is normative. This means that, to obtain the certificate, the candidate organization must meet all its requirements.

The documented response to the requirements of Appendix A must be formalized in the Statement of Applicability (SoA). This document describes the security objectives and appropriate measures applicable to the organization's information security management system.