Common exclusions and their justification
Most organizations exclude a handful of controls with clear justification. Auditors accept exclusions that reflect actual scope and risk, not convenience.
| Control | Typical Justification |
|---|
| A.7.4 Physical security monitoring | All processing occurs in AWS GovCloud or Microsoft Azure with inherited physical controls from the cloud provider's own certifications |
| A.7.9 Security of assets off-premises | Employees work remotely but use company-managed MDM laptops with full-disk encryption, MDM enrollment, and remote wipe capability |
| A.8.10 Information deletion | Cloud-native workloads use AWS S3 Object Lock or Azure Blob Immutable Storage for retention requirements that override deletion |
| A.8.19 Installation of software on operational systems | All production systems run immutable container images with no in-place installations permitted |
Source: ISO 27001 SoA review with multiple certified organizations, 2026.
SoA review and audit cadence
The SoA should be reviewed at least annually and updated for significant changes. Treat the SoA as a living document that management reviews during the management review meeting and that auditors can read to understand your entire ISMS at a glance. Outdated SoAs are a leading indicator of an aging ISMS program.
Internal links
See related ISO 27001 implementation guides: ISO 27001 cost guide, SOC 2 audit prep checklist, and HIPAA risk assessment template.
FAQs
See FAQ section above for SoA purpose, Annex A control counts in ISO 27001:2022, exclusion rules, signature authority, and update cadence.
Annex A control themes and examples
ISO 27001:2022 Annex A consolidates controls into four themes. Understanding the structure helps build a logical SoA document that auditors can review efficiently.
| Theme | Categories | Example Controls |
|---|
| Organizational (37 controls) | A.5 Policies, A.6 People, A.7 Physical, A.8 Tech (org level) | A.5.1 Information security policies, A.5.7 Threat intelligence, A.5.19 Supplier relationships |
| People (8 controls) | A.6 People controls | A.6.1 Screening, A.6.3 Awareness training, A.6.8 Disciplinary process |
| Physical (14 controls) | A.7 Physical controls | A.7.1 Physical security perimeter, A.7.4 Monitoring, A.7.9 Off-premises |
| Technological (34 controls) | A.8 Technical controls | A.8.2 Privileged access, A.8.5 Auth, A.8.24 Crypto, A.8.28 Secure coding |
Source: ISO/IEC 27001:2022 Annex A structure, 2026.
FAQ expansion
Q: What is the difference between required and addressable controls in ISO 27001? ISO 27001 uses "shall" for required controls (must implement) and "should" for addressable controls (must implement or document alternative). Annex A controls use "control" language that requires implementation unless an exclusion is justified.
Q: How long does ISO 27001 certification take? ISO 27001 certification typically takes 9-18 months for a first-time certification. The schedule driver is remediation of identified gaps. Many organizations spend 6-12 months implementing missing controls before the certification audit, then 2-3 months for the audit and report issuance.
Q: Can ISO 27001 and SOC 2 be done together? Yes. ISO 27001 and SOC 2 share 70-80 percent of their control requirements. Many organizations pursue both certifications simultaneously to maximize audit efficiency. Auditors can often do combined Stage 1 / readiness and combined certification / Type II audits with shared evidence.
Fazlur Rahman
