Glossary · ISO and management systems
Annex A is a menu of safeguards, and the auditor checks why you ordered what you did.
The reference list of 93 information security controls in ISO/IEC 27001:2022, grouped into organizational, people, physical and technological themes, which an organization compares its own controls against.
Back to the glossary01 · In plain words
In plain words
The reference list of 93 information security controls in ISO/IEC 27001:2022, grouped into organizational, people, physical and technological themes, which an organization compares its own controls against.
ISO/IEC 27001 has a back section, Annex A, that lists security safeguards by name, from access rights to secure coding. You do not copy it as a checklist. You decide which controls your risks call for, and you check the list to make sure you have not missed one.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Annex A is where risk work becomes visible. Every control you include or leave out lands in the Statement of Applicability, and the auditor reads that document early. A control marked applicable must be running and have evidence. A control marked not applicable needs a reason that holds up against your scope. Teams that treat Annex A as a 93-item to-do list overbuild and still miss the point, because the auditor asks how each control ties back to a risk, not whether the list is complete.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- The Statement of Applicability
- One row per Annex A control, with included or excluded, the reason, and whether it is in place.
- The risk treatment plan
- Each treated risk names the controls chosen to reduce it, usually with Annex A references.
- Stage 2 audit sampling
- Auditors pick controls from the list and ask to see them working, for example a leaver whose access was removed.
- ISO/IEC 27002
- The companion guidance standard explains each control in more depth; Annex A only names it and states its purpose.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a fully remote analytics start-up and the physical controls
A twelve-person analytics company has no office and hosts everything with a cloud provider. Reading the 14 physical controls, its lead marks several as not applicable, citing the remote setup and the provider's own certified data centres. She keeps two in scope: protecting laptops used at home and secure disposal of old devices. At Stage 2 the auditor accepts the exclusions because the scope statement and supplier records back them, then asks for the device disposal log. That log is the evidence that matters.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Clauses 4 to 10
- The clauses set the management system requirements every certified organization must meet. Annex A controls are selected based on risk.
- ISO/IEC 27002
- A separate guidance standard with implementation advice per control. You certify against 27001, not 27002.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Finish the risk assessment before choosing controls, so each choice has a reason.
- Mark every control included or excluded in the Statement of Applicability, with a one-line reason.
- Name an owner and an evidence source for each included control.
- Test a sample yourself during the internal audit, the way an external auditor would.
- GuideISO 27001 Annex A controlsAll 93 controls in four themes, with what each one asks.
- GuideThe Statement of ApplicabilityHow to build the document auditors open first.
- GuideAnnex A technological controlsThe 34 controls on systems, networks, code and data.
Sources: public ISO summaries of ISO/IEC 27001:2022 and ISO/IEC 27002:2022 (control names and themes only).
Questions about Annex A controls
Can we exclude Annex A controls?
Yes, with a justified reason.
An exclusion is acceptable when your risks or scope do not call for the control. The reason goes in the Statement of Applicability and must agree with the rest of your records. "We have not done it yet" is not a reason.
Why did the number of controls change from 114 to 93?
The 2022 revision merged and regrouped them.
The 2013 edition had 114 controls in 14 domains. The 2022 edition consolidated them into 93 controls in four themes and added some new ones, such as threat intelligence and secure coding.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.