The SoA details which controls you have in place to manage the risks to the security of your confidential or sensitive information.