Statement of Applicability (ISO 27001)

Legislation checked · 26 June 2026 Not yet advocate-reviewed Execution steps not yet documented

Drafted by:: Lekha editorial team
Version:: v0.1
Last checked against current law:: 15 May 2026
Next scheduled review:: 15 November 2026

Statutory sources (4)

Digital Personal Data Protection Act, 2023Official statuteofficial source
Indian Contract Act, 1872Official statuteofficial source
Code of Civil Procedure, 1908Official statuteofficial source
Arbitration and Conciliation Act, 1996Official statuteofficial source

These badges show which checks this document has passed. They are not a judgment of whether it is legally valid or right for your situation — for a high-stakes matter, have an advocate review it →

After you download

Fill every [BRACKETED PLACEHOLDER] before signing — open the downloaded file and search for "[" to catch any you missed.
Check stamp duty for your state — many Indian documents are only enforceable on adequate stamp paper or e-stamp; the amount varies by state and document type.
Sign as required — check whether the document needs witnesses, and whether all parties must initial each page.
Check registration — some documents (e.g. certain leases, gift deeds) must be registered with the Sub-Registrar to be fully effective.
Keep signed originals safe and give every party a copy; note any filing, renewal, or compliance deadlines the document creates.

Generic checklist — document-specific stamping and filing steps for this template are being documented.

Generate a Statement of Applicability (ISO 27001) for India, free. The ISO 27001 Statement of Applicability, assessed control-by-control across all 93 ISO/IEC 27002:2022 Annex A controls — applicability, justification, and recorded exclusions. A mandatory ISMS document under ISO 27001 clause 6.1.3. Fill a guided online form and download as PDF or DOCX or XLSX — no signup, no watermark, no cost.

✅ Free, no signup

Generate and download with no account and no payment.

⬇ DOCX & PDF

Download as PDF / DOCX / XLSX.

🇮🇳 India-first

Follows Indian legal conventions and state rules.

Frequently asked questions

Is the Statement of Applicability (ISO 27001) free to use?

Yes. Lekha is completely free — generate and download your Statement of Applicability (ISO 27001) with no payment and no account required.

What format do I get?

You can download the Statement of Applicability (ISO 27001) as PDF, DOCX, XLSX.

Is this Statement of Applicability (ISO 27001) valid in India?

The template follows India legal conventions. For high-stakes matters, have it reviewed by a qualified lawyer — Lekha lists verified advocates for free.

Organisation and scope

Organisation name *

Effective date *

ISMS owner *

ISMS scope *The boundaries of the information security management system

Control themes (ISO/IEC 27002:2022)

Organizational controls (A.5, 37 controls) *

People controls (A.6, 8 controls) *

Physical controls (A.7, 14 controls) *

Technological controls (A.8, 34 controls) *

Exclusions and approval

Excluded controlsOne per line: control | reason for exclusion (for example A.7.4 Physical monitoring | fully remote, no office)

Approved by *

Approval date *

10 required fields left.

📋

Template verified May 2026 — checked against applicable central Acts and current state rules. Legal requirements can change; for property transactions above ₹5 lakh, employment disputes, or business agreements above ₹10 lakh, have a lawyer review it before signing →. Run Lekha Audit on any document you receive →

Attachments

Keep your letterhead, logo, or supporting documents handy while you fill the form. To analyse a document with AI, use Lekha Audit above.

Click or drag files here

Letterhead (PNG/JPG), Logo, PDFs — max 5 MB each

Live preview

0 of 10 essentials added

STATEMENT OF APPLICABILITY

Effective Date
ISMS Owner
Controls applicable: 93 of 93

1. ISMS scope

operates an ISMS owned by . Scope: .

2. Applicability of Annex A controls

Each of the 93 controls in ISO/IEC 27001:2022 Annex A is assessed below: 93 applicable, 0 excluded with justification. Controls are grouped by the four Annex A themes.

A.5 — Organizational controls (37)

Control	Title	Applicable	Justification
A.5.1	Policies for information security	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.2	Information security roles and responsibilities	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.3	Segregation of duties	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.4	Management responsibilities	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.5	Contact with authorities	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.6	Contact with special interest groups	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.7	Threat intelligence	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.8	Information security in project management	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.9	Inventory of information and other associated assets	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.10	Acceptable use of information and other associated assets	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.11	Return of assets	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.12	Classification of information	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.13	Labelling of information	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.14	Information transfer	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.15	Access control	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.16	Identity management	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.17	Authentication information	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.18	Access rights	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.19	Information security in supplier relationships	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.20	Addressing information security within supplier agreements	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.21	Managing information security in the ICT supply chain	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.22	Monitoring, review and change management of supplier services	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.23	Information security for use of cloud services	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.24	Information security incident management planning and preparation	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.25	Assessment and decision on information security events	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.26	Response to information security incidents	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.27	Learning from information security incidents	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.28	Collection of evidence	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.29	Information security during disruption	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.30	ICT readiness for business continuity	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.31	Legal, statutory, regulatory and contractual requirements	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.32	Intellectual property rights	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.33	Protection of records	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.34	Privacy and protection of personal identifiable information (PII)	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.35	Independent review of information security	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.36	Compliance with policies, rules and standards for information security	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.5.37	Documented operating procedures	Yes	Applicable — treated through the organisation's ISMS policies and controls

A.6 — People controls (8)

Control	Title	Applicable	Justification
A.6.1	Screening	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.6.2	Terms and conditions of employment	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.6.3	Information security awareness, education and training	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.6.4	Disciplinary process	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.6.5	Responsibilities after termination or change of employment	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.6.6	Confidentiality or non-disclosure agreements	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.6.7	Remote working	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.6.8	Information security event reporting	Yes	Applicable — treated through the organisation's ISMS policies and controls

A.7 — Physical controls (14)

Control	Title	Applicable	Justification
A.7.1	Physical security perimeters	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.7.2	Physical entry	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.7.3	Securing offices, rooms and facilities	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.7.4	Physical security monitoring	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.7.5	Protecting against physical and environmental threats	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.7.6	Working in secure areas	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.7.7	Clear desk and clear screen	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.7.8	Equipment siting and protection	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.7.9	Security of assets off-premises	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.7.10	Storage media	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.7.11	Supporting utilities	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.7.12	Cabling security	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.7.13	Equipment maintenance	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.7.14	Secure disposal or re-use of equipment	Yes	Applicable — treated through the organisation's ISMS policies and controls

A.8 — Technological controls (34)

Control	Title	Applicable	Justification
A.8.1	User endpoint devices	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.2	Privileged access rights	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.3	Information access restriction	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.4	Access to source code	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.5	Secure authentication	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.6	Capacity management	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.7	Protection against malware	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.8	Management of technical vulnerabilities	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.9	Configuration management	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.10	Information deletion	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.11	Data masking	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.12	Data leakage prevention	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.13	Information backup	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.14	Redundancy of information processing facilities	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.15	Logging	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.16	Monitoring activities	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.17	Clock synchronization	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.18	Use of privileged utility programs	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.19	Installation of software on operational systems	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.20	Networks security	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.21	Security of network services	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.22	Segregation of networks	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.23	Web filtering	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.24	Use of cryptography	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.25	Secure development life cycle	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.26	Application security requirements	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.27	Secure system architecture and engineering principles	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.28	Secure coding	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.29	Security testing in development and acceptance	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.30	Outsourced development	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.31	Separation of development, test and production environments	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.32	Change management	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.33	Test information	Yes	Applicable — treated through the organisation's ISMS policies and controls
A.8.34	Protection of information systems during audit testing	Yes	Applicable — treated through the organisation's ISMS policies and controls

3. Exclusions

No controls are excluded; all 93 Annex A controls are applicable and in scope.

4. Approval

Approved by on [date].

Approved by

ISMS Owner

Connected legal intelligence

Everything on Lekha that relates to this document — the clauses inside it, what to do next, the law to learn, and the risks to watch. Educational, not legal advice.

Clauses inside, explained

Data protection (DPDP)Indemnity Governing law & jurisdiction

Full clause library →

Acts this document touches

Trace each Act to the clauses and other templates connected to it.

Digital Personal Data Protection Act, 2023 Indian Contract Act, 1872 Code of Civil Procedure, 1908 Arbitration and Conciliation Act, 1996

Common risks to watch

Data protection (DPDP). Allocates responsibilities for handling personal data under Indian law.
Indemnity. Allocates who bears the cost if a third party brings a claim.
Governing law & jurisdiction. Fixes which State's courts and which body of law decide any dispute under the document.

Learn the law

📖 GuidesDPDP Act 2023: what every Indian website now needs →

Applicable compliance

Track these in your organisation's compliance register.

DPDP Act 2023 readiness

Published privacy policy

Open compliance register →

Related templates

Governance and Compliance Framework Charter DPDP Data-Protection Readiness Assessment AI Use and Governance Policy Incident Response Plan Risk Register Data Retention Schedule

🤖 Ask Vidhi about this documentor use the ✨ Ask AI bubble on any page.

After you download

Frequently asked questions

Organisation and scope

Control themes (ISO/IEC 27002:2022)

Exclusions and approval

📎Attachments

Connected legal intelligence

⚖️ Clauses inside, explained

🏛️ Acts this document touches

⚠️ Common risks to watch

📚 Learn the law

✅ Applicable compliance

📄 Related templates