ISO 27001 Annex A Controls: How to Choose and Record Them

Annex A of ISO 27001 lists 93 controls, which makes many people assume they must implement all of them. They do not.

A technical primer

• Annex A groups controls into organisational, people, physical and technological themes.
• Your risk assessment decides which controls you need.
• Annex A is then used to check you have not missed any.
• The Statement of Applicability records what you chose, its status and the reason for any exclusion.

Auditors will ask for evidence that each selected control actually operates.

Why this matters

If your risk assessment flags lost laptops, you might select controls for device encryption, remote wipe and an asset inventory. Each one is recorded, given an owner and backed by evidence.

A practical next step

If a control does not apply, such as secure development for a business that writes no software, record that and the reason. A clear reason is accepted by auditors. A blank is not.

Where to go next

If you want more detail, read Annex A explained with examples on the IT Support 247 blog. If you would like help applying it to your own organisation, see ISO 27001 guidance for Australian businesses.

IT Support 247 is a Melbourne IT support and compliance provider working with organisations across Australia.