Part 3: Risk treatment: The ISO 27001 Statement of Applicability The SoA (Statement of Applicability) is one of the most important ISO 27001 documents you will produce. It should: Identify the controls ...