Statement of applicability

What the screen is for#

ISO 27001 requires a Statement of Applicability: for each of the 93 Annex A controls, does it apply to your organisation, why, and how far has it been implemented. This screen keeps it and has it approved. Annex A is arranged in four families: "Organizational", "People", "Physical" and "Technological".

Each version is either a "Draft" or "Approved". An approved version is locked.

Who can do what#

Without the right to edit, the screen shows "Read only".

Step by step#

Justify a control#

1. Find the control. Use "Search" (code or title, for example A.8.32), "Family", "State", "Excluded controls" or "To complete only". "Reset" clears the filters.
2. Click the row to open the detail panel. It explains "What this control asks for", gives "Examples of evidence" and states "What Jira / JSM / Confluence / Assets can prove".
3. Under "Your answer", leave "This control applies to our organization" ticked, or untick it to exclude the control. An excluded control must be justified, like a kept one.
4. Write the "Justification". It is saved when you leave the field (2,000 characters at most).
5. Read the "Implementation state": it is no longer typed. It is worked out from the common controls that cover the requirement ("Non mis en œuvre", "Partiellement mis en œuvre" or "Mis en œuvre"), and the panel lists those controls with their state. To move it, work on the controls: assessment answers, verified tasks, evidence, tests. A draft shows the state live; an approved version keeps the state sealed at approval. An excluded requirement leaves the score.
6. Choose a "Owner" (at least two characters to search).
7. In "References", add a ticket, a page or a document that shows the implementation (200 characters at most, ten references per control). The panel shows "Saving…" then "Saved".

Approve the version#

1. Look at "Steps towards approval". The steps "Complete justifications" and "References for the implemented controls" block approval. The step "Implementation states filled in" is advice ("Advised", Recommended).
2. The "Other points to fix" section flags, for example, a control that is excluded while the treatment of an open risk relies on it. Reinstate the control or review the risk treatment.
3. Click "Check again" to run the check again.
4. When the "Approval" step says "Ready", click "Approuver". A window summarises the figures and reminds you that you attest to the accuracy of the statement. Confirm with "Approve the version".
5. The version is locked. The header shows who approved it and when.

Change an approved version#

1. Click "New revision".
2. A new draft is created from the approved version, which is kept as it is.
3. Edit, then approve the new version.

Grant roles#

Roles are not managed on this screen: they are in the "Access" tab of the Settings page. Jira administrators see a line under the steering table with the "Open the settings" link. See Roles.

The state comes from the common controls#

A requirement's implementation state is that of the common controls covering it, see the controls library. Evidence older than its frequency does not count: the control goes back to "Evidence to provide" and the requirement loses its credit. An approved version keeps the state sealed at approval.

Propose a justification Edition: Advanced#

In a row's panel, "Propose a justification" asks the assistant for two or three sentences to apply or exclude the requirement, from the requirement, the framework and the controls that cover it with their state. If there is no control, it says so instead of inventing one. The text is taken into the justification field; it is saved only with the screen's button. Who can ask: whoever edits the statement, or the person the control is assigned to. What goes to the model: AI assistant.

Import applicability and justifications#

While the statement is a draft, "Import" and "Download the template" (for whoever edits it) fill in "applicable", the justification and the owner of the requirements from an Excel workbook. See Import and export with Excel templates.

What the auditor will take from it#

A single, versioned document, signed with a name and a date, that covers the 93 controls with their justification. The auditor finds it in the audit pack (file declaration-applicabilite.csv). Every change and every approval is in the audit log.

Known limits#

• Free references are text: the app does not check that a ticket or document exists.
• An "Mis en œuvre" control must cite a task, a piece of evidence or a reference, otherwise the statement does not validate.
• Clauses 4 to 10 of the standard are not part of the statement: they are covered by the "Audits" tab.
• If someone else edits the same control at the same time, the screen reloads and asks you to start again.