Answer
Should the Statement of Applicability record control attributes?
It is not required, but it is useful. The SoA already lists the controls and the reason for inclusion or exclusion. Adding the five attribute columns lets an auditor, a board or a control owner read the same set from another angle without a second catalogue or a rewrite of the justifications.
What stays the same?
The control codes, the inclusion decisions and the justifications. The attribute is a view of the control, not a new requirement, and the justification should not be rewritten to carry it.
What changes?
The document gains columns, a version note and an approval. Each row needs an owner, a review date and a note where the organisation's value differs from Table A.1.
What is the audit risk?
A blank or inconsistent attribute column is worse than none, because it looks like a claim. Fill it completely or leave the decision to adopt on the record.
Check it yourself
All 93 controls The five attributes The publication record Run the free check
Source for this page
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27001:2022, the certifiable requirements. The management system requirements and Annex A, including the Statement of Applicability in clause 6.1.3.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.