Definition
ISO/IEC 27001:2022 · clause 6.1.3 d)The document that lists every Annex A control, says whether you have included or excluded it, justifies the choice, and records whether each included control is implemented. Auditors read it first, because it ties your risk treatment to the 93 reference controls and shows what the certificate covers. You can add controls from other sources, such as CERT-In or SEBI requirements, and list them alongside.
Also called SoA