Annex A of ISO/IEC 27001:2022 contains a comprehensive set of 93 security controls grouped into four major themes: Organisational, People, Physical, and Technological controls.
These controls form the backbone of an effective Information Security Management System (ISMS), helping organizations manage and mitigate information security risks.
What is Annex A?
Annex A provides a catalog of controls that organizations can select to treat identified information security risks as part of their ISMS risk treatment process.
It complements the main clauses (4–10) of the ISO/IEC 27001 standard, which define the overarching management system requirements, but do not prescribe specific controls.
The Four Themes of Annex A Controls
1. Organisational Controls (37 controls): These focus on policies, procedures, risk management, asset classification, identity and access management, and information security governance. Examples include defining information security responsibilities and monitoring threat intelligence.
2. People Controls (8 controls): These target personnel management such as pre-employment screening, security awareness training, contracts and NDAs, and reporting security events.
3. Physical Controls (14 controls): These protect the physical environment through measures such as secure areas, clear desk policies, environmental controls, and secure cabling.
4. Technological Controls (34 controls): These involve technical measures including malware protection, backups, logging and monitoring, secure network segregation, cryptography, and secure software development.
Mapping Controls to Risks
After identifying and assessing risks, organizations select appropriate Annex A controls to mitigate those risks.
The selected controls and exclusions must be documented clearly in the Statement of Applicability (SoA), which also justifies why controls are included or omitted. The SoA acts as both a planning and audit document.
Control Attributes and Categorization
ISO/IEC 27001:2022 introduces attributes to each control for easier categorization and implementation, including:
1. Control Type (Preventive, Detective, Corrective)
2. Information Security Properties (Confidentiality, Integrity, Availability)
3. Cybersecurity Concepts (Identify, Protect, Detect, Respond, Recover)
4. Operational Capabilities (Governance, Asset Management, etc.)
5. Security Domains (Governance and Ecosystem, Protection, Defence, Resilience)
Practical Steps to Map Controls
1. Define the ISMS Scope: Understand the boundaries and assets.
2. Identify Risks: Through risk assessment processes guided by ISO/IEC 27005.
3. Select Controls: Pick relevant Annex A controls to mitigate specific risks aligned with organizational context.
4. Document in SoA: Prepare the Statement of Applicability that lists selected controls and justifications.
5. Implement Controls: Apply controls through policies, processes, and technical measures.
6. Maintain and Review: Monitor control effectiveness and update selections as risks evolve.
Class Sessions
Sales Campaign
We have a sales campaign on our promoted courses and products. You can purchase 1 products at a discounted price up to 15% discount.