⌘K
- QuickstartGet from a new StayEvident account to your first AI conformance assessment: create your organisation, adopt a standard, upload documents and run it.
- Uploading your documentsAdd your documented information so the AI can assess it against your standards.
- Inviting your teamInvite colleagues and your external auditor to StayEvident, choose the right role for each, and manage members of your organisation.
- Choosing standardsAdopt the ISO standards you're pursuing and run them as one integrated management system.
- Clauses, controls & scopeHow StayEvident models a standard's clauses and controls, and how scope and exclusions work.
- AI assessmentsHow the AI assesses each clause against your documents, and how you review its findings.
- Evidence linkingConnect documents and register records to the clauses they evidence — AI proposes links, a person confirms them, and only confirmed evidence reaches your auditor.
- Statement of ApplicabilityGenerate an SoA from your scope decisions — always in sync with what you've assessed.
- Audit-day mode & audit packWalk your auditor through each clause with its confirmed evidence, or hand over a PDF pack.
- Registers & modulesThe operational registers StayEvident provides, and how they switch on for your standards.
- Roles & permissionsThe four built-in StayEvident roles — owner, admin, member and read-only auditor — and exactly what each one can see and do.
- Security & sign-inSign-in options, two-factor authentication, data isolation and the audit trail.
- Billing & plansHow StayEvident plans, limits and AI clause assessments work, what happens at a limit, and how to manage your subscription.
- FAQ & troubleshootingAnswers to common questions, and what to check when something doesn't look right.
- GlossaryThe terms used throughout StayEvident and the ISO standards it supports.
- No matching pages.
Documentation menu▾
Core Concepts/Statement of Applicability
Statement of Applicability
Generate an SoA from your scope decisions — always in sync with what you've assessed.
What it contains
Your Statement of Applicability is generated from the scope decisions you’ve already made, so it’s never a separate document to keep in sync. For each requirement it shows:
- Whether it’s included or excluded
- For exclusions, the justification — inherited from the parent if you excluded a whole clause or theme
- For included ISO/IEC 27001 Annex A controls, why it’s included (for example, risk treatment, legal, regulatory or contractual requirements) and any inclusion note
- Your scope statement
Viewing and exporting
Open an adopted standard and go to its applicability page to review and edit decisions, singly or in bulk. Choose Download PDF for a formatted SoA to hand to your certification body.
Because the on-screen view and the PDF are built from the same data, they always agree.
Tips for a defensible SoA
- Justify every exclusion in terms of your actual context. “Not applicable” on its own won’t survive Stage 1.
- Revisit exclusions when your scope changes — a new remote workforce or a new product line can make a previously excluded control applicable.
Questions this page didn't answer? Email [email protected].