ISO 27001 Controls: A Guide to Annex A

ISO 27001:2022 Annex A contains 93 controls, organised into four themes: 37 Organisational controls, 8 People controls, 14 Physical controls, and 34 Technological controls. This is a reduction from the 114 controls across 14 domains in the 2013 version. Eleven controls are entirely new in the 2022 version, covering areas such as cloud security, threat intelligence, and data leakage prevention. Organisations still certified to the 2013 standard must transition to the 2022 version by October 2025.

No. ISO 27001 requires you to select controls based on your risk assessment results, not implement all 93 by default. Controls that are not applicable to your organisation can be excluded, but every exclusion must be justified and documented in your Statement of Applicability. For example, a fully remote company with no physical office may legitimately exclude certain physical security controls. Auditors will scrutinise your exclusions closely, so justifications must be specific and risk-based, not generic.

The Statement of Applicability (SoA) is a mandatory document that records which Annex A controls you have selected, which you have excluded, the justification for each decision, and the current implementation status of each control. It is one of the first documents a certification auditor will request. The SoA must be kept current throughout your ISMS lifecycle. Any change to your risk profile, technology environment, or regulatory obligations may require the SoA to be updated and re-approved by management.

ISO 27001 is the auditable requirements standard. It specifies what your ISMS must do and lists the controls in Annex A that you select from. ISO 27002 is the implementation guidance standard. For each control in Annex A, ISO 27002 provides the control statement, its purpose, and detailed implementation guidance. You are certified against ISO 27001, not ISO 27002. However, ISO 27002 is an essential reference for understanding how to operationalise each control correctly. Our guide to iso 27002 covers the relationship in detail.

Many ISO 27001 Annex A controls directly address obligations under NIS2 Article 21, which mandates specific security measures for essential and important entities. Controls covering incident management (A.5.24 to A.5.28), supplier security (A.5.19 to A.5.22), business continuity (A.5.29 to A.5.30), and access control (A.8.2 to A.8.5) all map to NIS2 requirements. Implementing ISO 27001 controls does not automatically mean NIS2 compliance, but it substantially closes the gap and provides the audit-ready evidence regulators require.

ISO 27001 requires that your ISMS, including its controls, is reviewed continuously and formally assessed at least annually as part of management review. Individual controls should be monitored for effectiveness on an ongoing basis. Surveillance audits occur annually after initial certification, and a full recertification audit takes place every three years. Controls that have lapsed, lost evidence, or become ineffective due to changes in technology or organisational context must be remediated before the next audit cycle. Waiting until an audit is scheduled to review control posture is a common and costly mistake.