What it is
ISO/IEC 27001 asks an organization to run an information security management system and to decide which Annex A controls apply to it. The list of controls and the reasoning behind each choice make up the statement of applicability.
The workbook lists all 93 Annex A controls in the four themes (organizational, people, physical, technological) with space for applicability, justification, status, owner, evidence and review date. A clauses tab tracks the requirements of clauses 4 to 10, and the summary counts controls by theme and status. It is a self-assessment aid and does not certify anything.
When to use it
- A gap assessment before pursuing certification.
- Building a statement of applicability.
- Mapping the firm’s controls to a recognized framework.
What’s inside
- 93 Annex A controls by number and title
- Applicability, justification, status, owner, evidence and review date
- Clauses 4 to 10 tracker
- Summary by theme with tie-outs
Standard cited
This template follows ISO/IEC 27001:2022. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Does the workbook contain the standard’s text?
No. It lists control numbers and titles. Read the requirements in ISO/IEC 27001 and the guidance in ISO/IEC 27002 from ISO or your national standards body.
Does completing it mean the firm is certified?
No. Certification comes from an accredited certification body after an audit. This is a self-assessment.
Why does a No need a justification?
The statement of applicability must say why a control is excluded. The Flag column shows exclusions missing a reason.
Related templates
- Written Information Security Plan (WISP) for CPA Firms
- WISP Risk Assessment Worksheet (Excel)
- SOC 2 Readiness Checklist (Trust Services Criteria)
- Firm Technology and Data Inventory Register (Excel)
Last updated 11/05/2026. All free templates.