The correct answer is Record which security controls have been chosen to address identified risks and give the rationale for including or excluding each control.

This statement describes the purpose of the Statement of Applicability and of the SoA in an ISO 27001 based information security program. The document lists the controls an organization selected to treat identified risks and it records the justification for including or excluding each control. It maps those choices back to the risk assessment and to Annex A control objectives and it provides auditors and management with a clear record of why the control set was chosen.

The SoA may also note the implementation status of controls but it is primarily an evidence and justification document rather than a step by step implementation schedule.

Act as the formal risk treatment plan that describes how each identified risk will be handled and the associated implementation steps is incorrect because the SoA records which controls were chosen and why and it does not function as the detailed risk treatment plan that assigns actions, owners, and timelines. The treatment plan is a separate deliverable.

Provide an inventory of information assets with assigned value ratings for each item is incorrect because asset inventories and value ratings belong in an asset register that supports risk assessment. The SoA deals with controls, not with cataloguing asset values.

Define the security duties and responsibilities of staff and teams across the organization is incorrect because role definitions and responsibilities are captured in policies, job descriptions, and governance documents. The SoA documents control selection and justification rather than personnel roles.

Full AWS Practitioner Certification Question