ISO 27001 controls are the specific safeguards you use to treat information security risks, and Annex A is the reference list of them. You do not have to implement every control. You have to choose the right ones and explain why. This guide shows how Annex A works.
What ISO 27001 Controls Are in Annex A
Annex A lists 93 controls in ISO 27001:2022, grouped into four themes. It is a reference, not a checklist. You compare it with your risk assessment to make sure you have not missed a necessary control.
The Four Themes
- Organisational: policies, roles, supplier relationships, incident management and continuity.
- People: screening, awareness and responsibilities.
- Physical: secure areas, equipment and clear desks.
- Technological: access control, cryptography, logging, backup and secure development.
How to Choose Your Controls
Start with the risk assessment. For each risk, pick the controls that reduce it to an acceptable level. Then check Annex A for anything you missed. Record all of this in the Statement of Applicability.
Excluding a Control
You may exclude a control that does not apply, for example secure development if you do not build software. You must record the reason, and auditors will check it.
From Controls to Evidence
Each control needs a working process and evidence that it runs. See our guide to ISO 27001 implementation for the steps, or ask about our ISO 27001 service.
Remember that ISO 27001 controls only work when people follow them. Choose fewer controls you can run well over many you cannot.
Frequently Asked Questions
How many ISO 27001 controls are there?
ISO 27001:2022 Annex A contains 93 controls in four themes.
Do I have to implement all of them?
No. You select the controls that treat your risks and justify any exclusions.
What is the Statement of Applicability?
It is the document listing which Annex A controls you apply, whether they are implemented, and why any are excluded.
Did the 2022 update change the controls?
Yes. The controls were reduced and regrouped into four themes, with new ones added.