SAP Statement of Applicability states what ISO 27001 controls and policies are being applied by the operations of critical business systems and client technology for SAP IT Services. It benchmarks against the Annex A control set in the ISO 27001 standard.