Home / Knowledge hub / ISO 27001 Annex A
Knowledge hub
ISO 27001 Annex A
The list of security controls an ISO 27001 certified organisation chooses from.
What it means
Annex A is the reference list of information security controls attached to ISO 27001. In the 2022 edition it holds 93 controls, grouped into four themes: organisational, people, physical and technological. The 2013 edition had 114 controls in 14 groups.
The list is a menu, not a checklist you must complete. You assess your risks, pick the controls that treat them, and record the choice and the reason in a document called the Statement of Applicability. You may leave a control out only if you can justify it.
Why it matters
The Statement of Applicability is what an auditor reads first. It shows which controls you chose, whether they are in place, and why any were left out. A buyer who asks for it is checking whether your choices match their risk, so vague entries cause more questions than they answer.
Annex A is also where the technical controls sit. Controls on managing technical vulnerabilities, secure coding and security testing apply directly to your application. Those are the ones where a real test result, rather than a policy, gives the strongest evidence.
How it shows up
In day-to-day work the Annex A controls become tasks. Management of technical vulnerabilities means someone scans, triages and fixes. Security testing in development and acceptance means releases are tested before and after they ship. The related secure development practice is where code review and testing sit.
The usual mistakes: marking every control as applicable without anyone owning it, or excluding controls with a one-line excuse. For application controls, ask for proof. A penetration test report with retested fixes shows the control working, which a written procedure cannot do.
Questions people ask
ISO 27001 Annex A, answered
How many controls are in Annex A?
The 2022 edition has 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34).
The 2013 edition listed 114 controls in 14 groups, and organisations moved to the newer structure.
Do we have to implement every Annex A control?
No. You choose controls based on your risk assessment and record the decision in the Statement of Applicability. Leaving a control out needs a justification.
Auditors check that reasons make sense.
What is a Statement of Applicability?
A document listing each Annex A control, whether it applies, whether it is implemented, and why you included or excluded it. It is a core record for certification.
Customers sometimes ask to see it.
Which Annex A controls affect application security?
The technological theme matters most: managing technical vulnerabilities, secure coding, security testing during development and acceptance, and access control are the ones that touch the application directly.
Others cover change management and logging.
Can we add controls that are not in Annex A?
Yes. The standard allows additional controls from other sources, and you should add them when your risks need them. Annex A is a reference, not a ceiling.
Record them in the same way.
Sources
Where this comes from
Related
Terms that sit next to this one
ISO 27001
The international standard for running an information security management system.
Secure SDLC
Building security checks into every stage of how software is planned, built and shipped.
Vulnerability management
The loop of finding, prioritising, fixing and checking the fix held.
Access control
The rules deciding which person can see or do which thing in your app.
Risk register
A running list of risks, their owners, ratings and chosen responses.
Where does a control need evidence?
Some Annex A controls call for testing, not paperwork. We check web apps and APIs, with findings that carry the request, the response and the line of code, plus a retest that proves the fix. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.