A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →The Statement of Applicability (SoA) is a mandatory ISO 27001 document that lists every control in Annex A, states whether it applies to your scope, justifies each inclusion or exclusion, and records its implementation status. It is the bridge between your risk assessment and the controls you actually operate. Auditors read it closely, because it is where unjustified shortcuts show.
The SoA is the audit's map. The auditor works from it to sample controls, so it has to reflect what you actually do, not an idealised version. A gap between the SoA and reality is worse than a documented, justified exclusion.
Treat it as a living document. As scope changes and controls are added or retired, the SoA has to move with them, and a surveillance audit will compare this year's against last year's.
traztech delivers ISO 27001 implementation and Stage 2 readiness for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
The SoA surprises teams coming from SOC 2, which has no direct equivalent. It is not a formality; it is the document a certification body uses to decide what to audit, and an exclusion you cannot justify is a reliable source of findings. It is a core artefact in our ISO 27001 implementation work.
The common failure is excluding a control because it is inconvenient rather than because the risk assessment supports leaving it out. Every exclusion has to trace back to a reasoned decision, which is why the SoA is written after the risk work, not before it.
Yes. ISO 27001 requires it explicitly, and a certification body will not proceed without one. It is one of the defining artefacts of an ISO 27001 management system.
You can, but only with a justification grounded in your risk assessment and scope. Excluding a control simply because it is hard to implement is exactly what an auditor looks for.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.