Term

Annex A

The set of controls defined in ISO 27001.

Annex A of ISO 27001 lists 93 controls (in the 2022 revision) grouped into organisational, people, physical, and technological controls. Organizations tailor their Statement of Applicability from this list.

Annex A, explained

Annex A is the reference list of information security controls at the back of ISO/IEC 27001. It is normative, meaning certification auditors expect you to use it, but it is not a to-do list. Its role is to act as a completeness check: after you decide how to treat your risks, you compare your chosen controls against Annex A to make sure nothing necessary has been overlooked.

The four themes

Annex A in ISO/IEC 27001:2022

Annex A in ISO/IEC 27001:2022
Theme	Control numbers	Count	Examples
Organizational	5.1 to 5.37	37	Policies, asset inventory, supplier relationships, incident management, business continuity
People	6.1 to 6.8	8	Screening, awareness training, disciplinary process, remote working
Physical	7.1 to 7.14	14	Secure areas, equipment protection, clear desk, secure disposal of media
Technological	8.1 to 8.34	34	Endpoint devices, privileged access, logging, backup, secure coding

Numbering starts at 5 because the annex mirrors the clause structure of ISO/IEC 27002, where clauses 1 to 4 are introductory. The four themes replaced the 14 domains used in the 2013 edition.

What changed from 2013 to 2022

The 2013 edition listed 114 controls. The 2022 revision reduced this to 93 mainly by merging overlapping controls, and added 11 new ones reflecting how organizations now operate:

5.7 Threat intelligence
5.23 Information security for use of cloud services
5.30 ICT readiness for business continuity
7.4 Physical security monitoring
8.9 Configuration management
8.10 Information deletion
8.11 Data masking
8.12 Data leakage prevention
8.16 Monitoring activities
8.23 Web filtering
8.28 Secure coding

How Annex A connects to the rest of ISO 27001

Clause 6.1.2 requires a risk assessment, typically recorded in a risk register.
Clause 6.1.3 requires you to choose risk treatment options and determine the controls needed, from Annex A or any other source.
You then compare those controls with Annex A to verify none have been omitted.
The result is recorded in the Statement of Applicability, with a justification for including or excluding each Annex A control.

Annex A and ISO 27002

Annex A gives each control a title and a one or two sentence statement. ISO/IEC 27002 expands each one with its purpose, implementation guidance, and attributes such as control type (preventive, detective, corrective) and cybersecurity concept. You are audited against the Annex A wording, but 27002 is where most teams go to understand what a control really expects.

Pitfalls

Treating the 93 controls as the starting point and back-filling risks to justify them.
Excluding controls with generic reasons such as not applicable, which auditors will challenge.
Assuming Annex A is exhaustive. Your risks may need controls it does not name.
Maintaining a separate Annex A spreadsheet that drifts away from the controls you actually run.

For coverage of each theme and certification preparation, see the ISO 27001 framework page and the ISO 27001 complete guide.

FAQ

Frequently asked questions

Do I have to implement all 93 Annex A controls?

No. You implement the controls your risk assessment and treatment show to be necessary, plus any required by law or contract. Every Annex A control must appear in your Statement of Applicability, but excluded ones only need a sound justification. In practice most organizations find the majority apply, though often in a scaled-down form.

Can I use controls that are not in Annex A?

Yes. ISO 27001 allows controls from any source, including other frameworks, industry standards, or controls you design yourself. Annex A is used as a cross-check to confirm nothing necessary was missed, not as a limit on what you can implement.

Why does Annex A numbering start at 5?

The Annex A control numbers align with the clause numbers in ISO/IEC 27002:2022, where clauses 1 to 4 cover scope, references, terms, and structure. Controls begin at clause 5, organizational controls, and run through clause 8, technological controls. Keeping the numbers identical makes it easy to look up guidance for a control.

How does Annex A relate to SOC 2?

They are separate frameworks, but their content overlaps heavily. Controls such as access management, logging, change management, and supplier oversight satisfy both Annex A and the SOC 2 Common Criteria. Organizations pursuing both typically build one control set and map it to each rather than implementing them independently.

Keep exploring