Lion Cipher Lab
Build an ISO/IEC 27001 Statement of Applicability as a data pipeline, and measure control coverage
- GRC / Compliance
- Intermediate
- ~60 min
- Free · no account required
Why it matters
A Statement of Applicability is the one document an ISO/IEC 27001 auditor opens first: it records, for every Annex A control, whether it applies to your scope, why, whether it is implemented, and the evidence. Most people build it as a spreadsheet and quietly make it look finished by marking everything applicable and implemented. That instinct is exactly backwards, and at 93 controls it is impossible to check by eye. Building the SoA as a small data pipeline fixes both problems. You generate the whole 93-control Annex A catalogue once, join it to your risk register, and then let a script…
What you'll learn
- shipping the full ISO/IEC 27001:2022 Annex A control catalogue (93 controls across the organizational, people, physical and technological themes) as a CSV you generate offline, with the official short titles
- building a Statement of Applicability as a reproducible data join: Annex A controls x a risk register x an implementation record, instead of hand-editing a spreadsheet
- measuring an SoA the way an auditor reads it: coverage % (implemented / applicable), and the controls that are applicable with no justification, applicable with no linked risk, excluded with no documented reason, or claimed implemented with no evidence
- seeing why a 100%-'implemented' SoA with blank justifications passes a checkbox but fails an audit (279 findings), and why an honest 51.8%-coverage SoA with zero findings is the stronger document
- writing legitimate exclusions that are facts about scope (a fully-remote, cloud-hosted company excludes the premises physical controls) rather than work you have not done
- the pro habit: a justification tied to a risk ID and an evidence location, re-measured every cycle, so coverage is traceable rather than asserted
Steps in this lab
- Why the SoA exists, and why counting controls is not managing risk
- Ship the Annex A:2022 catalogue as a CSV
- Add a risk register, then build the SoA as a join
- Measure the BEFORE: the lazy SoA that passes a checkbox and fails the audit
- Measure the AFTER: justified, risk-linked, honest about what is not done
- The traps: a 100% SoA is a red flag, and the 114 to 93 renumbering
- The judgment: when an exclusion is legitimate, and the pro habit