What is a Declaration of Conformity?
The Statement of Applicability (SoA) is a key document within an Information Security Management System (ISMS) based on the ISO/IEC 27001 standard. It identifies the security controls applicable to the organisation, justifies their inclusion or exclusion, and reflects their implementation status. It serves as a reference for auditors, clients and stakeholders, demonstrating how the organisation manages and protects information in accordance with the identified risks.
Statement of Conformity with ISO 27001
The controls included in the Statement of Applicability (SoA) are taken from Annex A of the ISO 27001 standard, which contains a total of 93 controls, grouped into four main categories:
- Organisational controls (37 controls). Policies, roles, responsibilities, resource management, protection against threats, etc.
- People controls (8 controls). Training, awareness, staff responsibilities, security in employment relationships.
- Physical controls (14 controls). Physical access security, equipment protection, security in offices and critical environments.
- Technological controls (34 controls). Access management, encryption, protection against malware, backup, monitoring, vulnerability management.
Each organisation selects the applicable controls based on its risk analysis and legal, contractual or stakeholder requirements.
Declaration of Conformity to ENS
In the National Security Framework (ENS), the “Statement of Applicability (SoA)” is the document that identifies the security measures applicable to a system according to its category: BASIC, MEDIUM or HIGH.
These measures are established in Annex II of the ENS and are grouped into three main blocks:
- Organizational Framework (15 measures). This refers to measures related to management, organization and internal regulations, such as: security policy, security function, security rules, risk management, training and awareness, personnel management, security in external contracting, continuity management and security auditing.
- Operational Framework (34 measures). This includes the technical and procedural measures required for secure daily operation, such as: planning and change control, protection against malicious code, media management, activity logging, continuous monitoring, incident management, backups and physical and logical access control.
- Protection Measures (18 measures). These are controls designed to protect information and services against threats, such as: communications protection, protection of external services, protection against denial-of-service attacks, cryptographic protection, vulnerability management, protection against impersonation and manipulation, and service isolation.
The ENS Statement of Applicability includes:
- The list of applicable measures according to the system category: Basic, Medium or High.
- The justification for their application, adaptation or non-application.
- The implementation status of each measure.