ISO/IEC 27001:2022 Statement of Applicability Excel Template
A premade Excel workbook for your SoA. It lists all 93 Annex A controls, checks every row as you fill it in, and comes with a complete worked example.
| ID | Control | Applicable? | Implementation status | Owner | Check |
|---|---|---|---|---|---|
| 5.1 | Security policy framework | Yes | Implemented | ISMS Manager | OK |
| 5.3 | Conflicting duties split | Yes | Planned | CTO | Target date missing |
| 5.5 | Authority contacts | Yes | Implemented | Data Protection Lead | Evidence missing |
| 5.7 | Threat intelligence | TBD | Partially implemented | ISMS Manager | Decision missing |
| 7.6 | Working in secure areas | No | N/A (excluded) | OK |
Yellow cells are yours to fill in. Control labels are short descriptions written for this template, not the official ISO titles.
What you get
Two Excel files (.xlsx), delivered as an instant download after purchase. The product is premade and self-service: instructions are built into the workbook.
SoA Template (the main product)
- Start Here: step-by-step instructions and an explanation of every check
- Setup: organisation details, scope, version, review period and control owners
- SoA: 93 Annex A controls plus 10 rows for your own additional controls
- Dashboard: applicability, implementation status, open issues and workload by owner, with two charts
- Audit Trouble Spots: original guidance for 15 controls
- Change Log: version and approval history
Worked Example
- The same workbook, completed for a fictional 40-person SaaS company
- All 93 controls filled in, including three realistic exclusions
- A company profile explaining the facts behind each decision
What the Check column tests
- A control with no applicability decision
- An exclusion with a missing or weak justification
- A basis that does not match the decision
- An applicable control without owner, status or justification
- "Implemented" with no documents or evidence recorded
- Planned or partial work without a target date
- Overdue target dates
- Status values that contradict the applicability decision
- Entries not reviewed within your chosen review period
Compatibility
Designed for Microsoft Excel 2010 or later on Windows. No Microsoft 365-only functions are used, and formulas have been tested in LibreOffice Calc. Excel for Mac and Google Sheets have not been tested, so compatibility of formulas, dropdowns, charts and formatting on those platforms is not guaranteed.
Pricing
| Product | Price | Billing |
|---|---|---|
| ISO/IEC 27001:2022 SoA Excel Template (2 files) | $19 USD | One-time payment |
There are no subscriptions, add-ons or upsells. One purchase covers use within one organisation. Prices are in US dollars. Applicable sales taxes are calculated at checkout. Payments are processed by Lemon Squeezy.
FAQ
Does this include the text of ISO/IEC 27001?
No. Controls are listed by their Annex A number with short descriptive labels written for this template, and all guidance is original. Use it alongside your own licensed copy of the standard.
Do you offer consultancy or customisation?
No. The product is a premade digital download. We do not provide consultancy, customisation, implementation services or calls.
Will this guarantee certification?
No. Certification decisions are made by accredited certification bodies based on your whole management system. The template helps you build and check your Statement of Applicability. It cannot guarantee any audit outcome.
Can I use the worked example as my SoA?
No. It describes a fictional company. Use it as a reference and complete the blank template for your own organisation.
Terms of Service
Last updated: 21 September 2026
These terms apply to purchases of ReadyISMS digital products. By buying a product you agree to them.
Orders and payment
Orders are processed by Lemon Squeezy, which acts as the merchant of record and handles payment, invoicing and applicable sales taxes. Lemon Squeezy's own terms also apply to the checkout.
Licence
Each purchase grants a non-exclusive, non-transferable licence to use and modify the files within one organisation. You may not resell, redistribute, share publicly or republish the files, in original or modified form, as a template or product. Consultants who use the template for several client organisations need one licence per client organisation.
Nature of the product
The products are premade templates provided for general guidance. They are not legal, audit or professional advice, and they do not guarantee certification or any audit outcome. ReadyISMS is independent and is not affiliated with, endorsed by, or approved by ISO or IEC. The products do not contain the text of any ISO standard.
Liability
The products are provided "as is". To the extent permitted by law, ReadyISMS is not liable for indirect or consequential losses arising from their use, and total liability is limited to the price paid for the product.
Changes
We may update these terms. The version published on this page at the time of purchase applies to that purchase.
Refund Policy
Last updated: 21 September 2026
Because the products are digital downloads delivered immediately, purchases are generally not refundable once the files have been downloaded.
If a file is faulty or will not open, contact us within 30 days of purchase at the address below. We will send a corrected file, and if we cannot fix the problem, we will issue a full refund.
Refunds are processed through Lemon Squeezy to the original payment method. Nothing in this policy limits any rights you have under the consumer law that applies to you.
Privacy Policy
Last updated: 21 September 2026
What we collect
When you buy a product, Lemon Squeezy processes your payment and order details as merchant of record, under its own privacy policy. We receive the order information needed to deliver the product and answer support requests, such as your name, email address and what you bought. We never receive your full card details.
Analytics
Our Lemon Squeezy store and checkout pages use Google Analytics to measure visits and purchases in aggregate. Google Analytics uses cookies. This information page does not set its own tracking cookies.
How we use it
We use your information only to deliver your purchase, provide support for faulty files, and understand how the store is used. We do not sell your data or use it for advertising.
Retention and your rights
We keep order information only as long as needed for delivery, support and legal record-keeping. You can ask us to access, correct or delete your information by emailing us at the address below.
Contact
Email: readyisms.support@gmail.com
We reply to product and order questions by email. We do not offer consultancy or calls.