/soa-generator

description: Generate ISO 27001 Statement of Applicability (SOA) with control selection justifications

ISO 27001 Statement of Applicability Generator

Generates a comprehensive Statement of Applicability (SOA) for ISO 27001 Annex A controls, including applicability decisions, implementation status, justifications, and evidence references required for certification audit.

Usage

/iso:soa-generator [scope] [options]

Arguments

• `$1` - Scope (optional): "cloud-only", "hybrid", "on-premise", or "full" (default: "full")
• `$2` - Options (optional): `--format=docx|xlsx|markdown`, `--include-evidence`, `--show-gaps-only`

Examples

# Generate full SOA for all 93 Annex A controls
/iso:soa-generator full

# Cloud-only SOA (excludes physical controls)
/iso:soa-generator cloud-only

# Export as Excel spreadsheet
/iso:soa-generator full --format=xlsx

# Show only gaps (controls not implemented)
/iso:soa-generator full --show-gaps-only

# Include evidence references
/iso:soa-generator full --include-evidence

Output

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ISO 27001:2022 STATEMENT OF APPLICABILITY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Organization: Your Company, Inc.
ISMS Scope: Cloud infrastructure and SaaS application platform
Date: 2025-01-28
Version: 1.0
Prepared By: Information Security Team
Approved By: CISO

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
EXECUTIVE SUMMARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Total Annex A Controls: 93
Applicable: 78 (84%)
Not Applicable: 15 (16%)

Implementation Status:
  ✓ Implemented: 62 (79% of applicable)
  ⚠ Partially Implemented: 11 (14% of applicable)
  ✗ Not Implemented: 5 (6% of applicable)
  ○ Not Applicable: 15 (16% of total)

Certification Readiness: 79% (Target: 100% before Stage 2 audit)

Risk Summary:
  - 5 controls not implemented represent MEDIUM risk
  - 11 partially implemented controls under remediation
  - Target completion date: Q2 2025

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
A.5 ORGANIZATIONAL CONTROLS (37 controls)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

A.5.1 - Policies for information security
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Status: ✓ APPLICABLE - IMPLEMENTED
Implementation Date: January 2024
Last Review: December 2024

Control Objective:
  To provide management direction and support for information security in
  accordance with business requirements and relevant laws and regulations.

Justification for Applicability:
  As a SaaS provider handling customer data, we require comprehensive
  information security policies to govern our operations, meet regulatory
  requirements (SOC 2, GDPR), and demonstrate commitment to security.

Implementation Description:
  Your Company maintains a comprehensive Information Security Policy (v2.1)
  approved by executive management and reviewed annually. The policy covers:
  - Information security objectives and strategy
  - Roles and responsibilities
  - Risk management approach
  - Asset classification and handling
  - Access control principles
  - Incident management
  - Business continuity

  Policy is communicated to all employees during onboarding and annually
  thereafter through mandatory security awareness training.

Evidence:
  - Information Security Policy v2.1 (approved 2024-01-15)
  - Executive management approval memo
  - Policy acknowledgment records (98% employee completion)
  - Annual policy review meeting minutes (2024-12-10)
  - Security awareness training completion records

Control Owner: CISO
Implementation Cost: $8,000 (initial policy development)
Annual Review: December (annually)

Cross-Reference:
  - NIST 800-53: PL-1, PM-1
  - SOC 2: CC1.1, CC1.2
  - GDPR: Article 24 (Security measures)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
A.5.2 - Information security roles and responsibilities
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Status: ✓ APPLICABLE - IMPLEMENTED
Implementation Date: January 2024

Control Objective:
  To ensure that information security responsibilities are defined and assigned.

Justification for Applicability:
  Clear definition of security roles ensures accountability and effective
  security management across the organization.

Implementation Description:
  Security roles and responsibilities are documented in:
  1. Organizational chart showing security reporting structure
  2. Job descriptions including security responsibilities
  3. RACI matrix for security processes

  Key Roles:
    - CISO: Overall security strategy and program management
    - Security Engineers: Technical security implementation and monitoring
    - IT Operations: Day-to-day security operations
    - Development Teams: Secure coding practices, security testing
    - All Employees: Following security policies, reporting incidents

  Responsibilities are reviewed during annual performance reviews and updated
  when organizational changes occur.

Evidence:
  - Organizational chart (updated 2024-11-01)
  - Job descriptions with security responsibilities
  - RACI matrix for ISMS processes
  - Performance review templates including security criteria
  - Security team charter (approved 2024-01-20)

Control Owner: CISO
Cross-Reference: NIST 800-53: PM-2; SOC 2: CC1.3

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
A.5.7 - Threat intelligence
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Status: ✓ APPLICABLE - PARTIALLY IMPLEMENTED
Implementation Date: March 2024 (in progress)
Target Completion: February 2025

Control Objective:
  To ensure that information related to information security threats is
  collected and analyzed to produce threat intelligence.

Justification for Applicability:
  As a cloud service provider, understanding the threat landscape is critical
  for proactive security measures and risk management.

Implementation Description:
  Current Implementation:
    ✓ AWS GuardDuty enabled (threat detection for AWS