What is Annex A?

The four themes

The 2022 edition numbers its controls by theme, starting at 5 to match the clauses of ISO 27002.

Eleven controls were new in 2022, among them threat intelligence, information security for cloud services, data leakage prevention, monitoring activities and secure coding.

• Organisational (5.1 to 5.37). 37 controls, covering policies, roles, supplier security, incident management, business continuity and legal requirements.
• People (6.1 to 6.8). Eight controls, covering screening, terms of employment, awareness and training, remote working and reporting security events.
• Physical (7.1 to 7.14). 14 controls, covering perimeters, entry, offices, monitoring, equipment and storage media.
• Technological (8.1 to 8.34). 34 controls, covering endpoints, privileged access, authentication, malware, backup, logging, networks and secure development.

How it is used

Clause 6.1.3 of ISO 27001 asks you to decide which controls you need to treat your risks, then compare them with Annex A to check that nothing necessary has been left out. Annex A works as a cross-check. You can design controls from any source, including other frameworks, as long as the comparison is made, so a control set already built for another framework can be checked against Annex A rather than rebuilt.

Every Annex A control then appears in the Statement of Applicability, marked as included or excluded with a reason, and with its implementation status. The requirements in clauses 4 to 10 apply to every certified organisation. Annex A controls apply where your risk treatment selects them, and auditors test the ones you include.

Annex A and ISO 27002

Annex A gives each control a title and a sentence or two. ISO 27002 is a separate guidance standard with the same numbering, which explains the purpose of each control, how to implement it, and a set of attributes for sorting controls by type and security property. Certification is against ISO 27001; ISO 27002 is guidance you can follow.

The 2013 edition had 114 controls in fourteen domains. The transition period for certificates issued against it ended on 31 October 2025, so current certificates use the 2022 list.

Related terms

Statement of Applicability (SoA)

The ISO 27001 document listing every Annex A control, whether it applies, why, and whether it is implemented. The auditor’s map of your ISMS.

ISMS

Information security management system: the scope, policies, risk process, controls and reviews that ISO 27001 certifies. The certificate covers the management system, not a product.

Control

A specific safeguard or activity that reduces a risk, such as requiring MFA on privileged accounts or reviewing access every quarter. Frameworks are, in large part, lists of controls.

Control mapping

Linking one control to every framework requirement it satisfies, so the same control and its evidence count towards SOC 2, ISO 27001 and other frameworks at once.

Risk register

The list of identified risks with an owner, likelihood, impact, treatment and review date, linked to the controls that treat each one. Usually the first document an auditor asks to see.