Annex A: Statement of Applicability

The Statement of Applicability lists the 93 information security controls of ISO/IEC 27001:2022 Annex A, whether they apply to the ISMS, why, which role owns them, and which policy describes how we meet them. It is published so customers and other interested parties can read it. How each control is implemented, with the evidence, is kept in the private Annex A implementation page, and every applicable control links to at least one risk in the risk register.

Justification: Risk treats a risk from the risk assessment, Legal is required by law or regulation (such as the GDPR), Contract is required by customer contracts, SLAs or tenders, Business is a business need of ours.

All controls apply. We exclude none, because each one supports the security of the SaaS products in scope.

5 Organizational controls

Control	Title	Applicable	Justification	Owner	Policy
5.1	Policies for information security	Yes	Risk, Contract	Information Security Officer	Information security
5.2	Information security roles and responsibilities	Yes	Risk	Management	Leadership
5.3	Segregation of duties	Yes	Risk	Management	Leadership
5.4	Management responsibilities	Yes	Risk	Management	Information security
5.5	Contact with authorities	Yes	Legal, Contract	Information Security Officer	Incident management
5.6	Contact with special interest groups	Yes	Business	Information Security Officer	Incident management
5.7	Threat intelligence	Yes	Risk	Information Security Officer	Operations security
5.8	Information security in project management	Yes	Risk	Project lead	Change management
5.9	Inventory of information and other associated assets	Yes	Risk, Contract	Information Security Officer	Asset management
5.10	Acceptable use of information and other associated assets	Yes	Risk	Information Security Officer	Information handling
5.11	Return of assets	Yes	Risk	Office & HR	Asset management
5.12	Classification of information	Yes	Risk, Contract	Information Security Officer	Information handling
5.13	Labelling of information	Yes	Risk	Information Security Officer	Information handling
5.14	Information transfer	Yes	Risk, Legal	Information Security Officer	Information handling
5.15	Access control	Yes	Risk, Contract	Information Security Officer	Access control
5.16	Identity management	Yes	Risk	Infrastructure	Access control
5.17	Authentication information	Yes	Risk	Infrastructure	Access control
5.18	Access rights	Yes	Risk	Information Security Officer	Access control
5.19	Information security in supplier relationships	Yes	Risk, Legal	Information Security Officer	Supplier management
5.20	Addressing information security within supplier agreements	Yes	Legal, Contract	Management	Supplier management
5.21	Managing information security in the ICT supply chain	Yes	Risk	Infrastructure	Supplier management
5.22	Monitoring, review and change management of supplier services	Yes	Risk, Contract	Information Security Officer	Supplier management
5.23	Information security for use of cloud services	Yes	Risk	Infrastructure	Supplier management
5.24	Information security incident management planning and preparation	Yes	Risk, Contract	Information Security Officer	Incident management
5.25	Assessment and decision on information security events	Yes	Risk	Information Security Officer	Incident management
5.26	Response to information security incidents	Yes	Risk	Information Security Officer	Incident management
5.27	Learning from information security incidents	Yes	Risk	Information Security Officer	Incident management
5.28	Collection of evidence	Yes	Risk, Legal	Infrastructure	Incident management
5.29	Information security during disruption	Yes	Risk, Contract	Infrastructure	Business continuity
5.30	ICT readiness for business continuity	Yes	Risk, Contract	Infrastructure	Business continuity
5.31	Legal, statutory, regulatory and contractual requirements	Yes	Legal, Contract	Management	Information security
5.32	Intellectual property rights	Yes	Legal, Contract	Project lead	Secure development
5.33	Protection of records	Yes	Legal	Office & HR	Information handling
5.34	Privacy and protection of PII	Yes	Legal, Contract	Project lead	Information handling
5.35	Independent review of information security	Yes	Business, Contract	Management	Information security
5.36	Compliance with policies, rules and standards for information security	Yes	Risk	Information Security Officer	Information security
5.37	Documented operating procedures	Yes	Risk	Information Security Officer	Information security

6 People controls

Control	Title	Applicable	Justification	Owner	Policy
6.1	Screening	Yes	Risk, Legal	Office & HR	People security
6.2	Terms and conditions of employment	Yes	Risk, Legal	Office & HR	People security
6.3	Information security awareness, education and training	Yes	Risk	Information Security Officer	People security
6.4	Disciplinary process	Yes	Risk, Legal	Management	People security
6.5	Responsibilities after termination or change of employment	Yes	Risk	Office & HR	People security
6.6	Confidentiality or non-disclosure agreements	Yes	Risk, Contract	Office & HR	People security
6.7	Remote working	Yes	Risk	Information Security Officer	People security
6.8	Information security event reporting	Yes	Risk	Information Security Officer	Incident management

7 Physical controls

Control	Title	Applicable	Justification	Owner	Policy
7.1	Physical security perimeters	Yes	Risk	Office & HR	Physical security
7.2	Physical entry	Yes	Risk	Office & HR	Physical security
7.3	Securing offices, rooms and facilities	Yes	Risk	Office & HR	Physical security
7.4	Physical security monitoring	Yes	Risk	Office & HR	Physical security
7.5	Protecting against physical and environmental threats	Yes	Risk	Infrastructure	Physical security
7.6	Working in secure areas	Yes	Risk	Office & HR	Physical security
7.7	Clear desk and clear screen	Yes	Risk	Office & HR	Physical security
7.8	Equipment siting and protection	Yes	Risk	Infrastructure	Physical security
7.9	Security of assets off-premises	Yes	Risk	Office & HR	Asset management
7.10	Storage media	Yes	Risk, Legal	Infrastructure	Asset management
7.11	Supporting utilities	Yes	Risk, Business	Infrastructure	Physical security
7.12	Cabling security	Yes	Risk	Infrastructure	Physical security
7.13	Equipment maintenance	Yes	Risk	Infrastructure	Physical security
7.14	Secure disposal or re-use of equipment	Yes	Risk, Legal	Infrastructure	Asset management

8 Technological controls

Control	Title	Applicable	Justification	Owner	Policy
8.1	User endpoint devices	Yes	Risk	Information Security Officer	Operations security
8.2	Privileged access rights	Yes	Risk	Infrastructure	Access control
8.3	Information access restriction	Yes	Risk, Contract	Infrastructure	Access control
8.4	Access to source code	Yes	Risk	Project lead	Access control
8.5	Secure authentication	Yes	Risk	Infrastructure	Access control
8.6	Capacity management	Yes	Business, Contract	Infrastructure	Operations security
8.7	Protection against malware	Yes	Risk	Infrastructure	Operations security
8.8	Management of technical vulnerabilities	Yes	Risk	Infrastructure	Operations security
8.9	Configuration management	Yes	Risk	Infrastructure	Operations security
8.10	Information deletion	Yes	Legal	Project lead	Information handling
8.11	Data masking	Yes	Legal	Project lead	Information handling
8.12	Data leakage prevention	Yes	Risk	Information Security Officer	Information handling
8.13	Information backup	Yes	Risk, Contract	Infrastructure	Business continuity
8.14	Redundancy of information processing facilities	Yes	Business, Contract	Infrastructure	Business continuity
8.15	Logging	Yes	Risk, Legal	Infrastructure	Operations security
8.16	Monitoring activities	Yes	Risk, Contract	Infrastructure	Operations security
8.17	Clock synchronization	Yes	Risk	Infrastructure	Operations security
8.18	Use of privileged utility programs	Yes	Risk	Infrastructure	Access control
8.19	Installation of software on operational systems	Yes	Risk	Infrastructure	Change management
8.20	Networks security	Yes	Risk	Infrastructure	Operations security
8.21	Security of network services	Yes	Risk, Contract	Infrastructure	Operations security
8.22	Segregation of networks	Yes	Risk	Infrastructure	Operations security
8.23	Web filtering	Yes	Risk	Information Security Officer	Operations security
8.24	Use of cryptography	Yes	Risk, Contract	Infrastructure	Information handling
8.25	Secure development life cycle	Yes	Risk, Business	Project lead	Secure development
8.26	Application security requirements	Yes	Legal, Contract	Project lead	Secure development
8.27	Secure system architecture and engineering principles	Yes	Risk	Project lead	Secure development
8.28	Secure coding	Yes	Risk	Project lead	Secure development
8.29	Security testing in development and acceptance	Yes	Risk	Project lead	Secure development
8.30	Outsourced development	Yes	Risk, Business	Project lead	Supplier management
8.31	Separation of development, test and production environments	Yes	Risk, Contract	Infrastructure	Secure development
8.32	Change management	Yes	Risk	Information Security Officer	Change management
8.33	Test information	Yes	Legal	Project lead	Secure development
8.34	Protection of information systems during audit testing	Yes	Risk	Infrastructure	Operations security

Review

The Information Security Officer reviews this statement with the policies every year and after changes to the scope or the risk assessment. Management approves it.