Organizations implementing ISO/IEC 27001 must apply security controls to manage and reduce information security risks. These controls are listed in Annex A of the standard and form a key part of building an effective Information Security Management System (ISMS).
Annex A provides a structured set of security controls that organizations can implement based on their risk assessment results. Not every control must be implemented; instead, organizations select the controls that are necessary to address identified risks.
In this guide, we explain the structure of ISO/IEC 27001 Annex A and the main categories of security controls.
Table of Contents
What Is Annex A in ISO/IEC 27001?
Annex A is a catalogue of security controls designed to help organizations manage information security risks.
These controls are derived from the guidance provided in ISO/IEC 27002, which offers detailed implementation recommendations.
Annex A acts as a reference checklist during the risk treatment process. After identifying risks, organizations choose appropriate controls from Annex A and document them in a Statement of Applicability (SoA).
Structure of Annex A Controls
In the latest version of ISO/IEC 27001, Annex A contains 93 security controls grouped into four major domains.
| Control Category | Purpose |
|---|---|
| Organizational Controls | Governance and security management processes |
| People Controls | Human resource security and awareness |
| Physical Controls | Protection of facilities and equipment |
| Technological Controls | Technical security measures |
Each control addresses a specific area of information security.
1. Organizational Controls
Organizational controls establish the governance framework for managing information security.
These controls focus on policies, procedures, and responsibilities that guide security management across the organization.
Key areas include:
- Information security policies
- Risk management processes
- Asset management
- Supplier security management
- Incident management
- Business continuity planning
- Compliance and legal requirements
These controls ensure that security responsibilities are clearly defined and consistently applied across the organization.
2. People Controls
People controls address the human element of cybersecurity.
Employees, contractors, and third parties often have access to sensitive information, so proper procedures are required to ensure they understand their security responsibilities.
Typical people controls include:
- Security awareness training
- Background verification procedures
- Acceptable use policies
- Disciplinary processes for security violations
- Access management procedures
- Termination or change-of-role procedures
These controls help reduce risks caused by human error, insider threats, or lack of awareness.
3. Physical Controls
Physical controls protect information assets from physical threats such as theft, damage, or unauthorized access.
These controls typically focus on protecting facilities, data centers, and equipment.
Examples include:
- Secure access to buildings and facilities
- Physical entry monitoring
- Equipment protection
- Environmental safeguards
- Secure disposal of media and devices
Physical security remains essential even in cloud-based environments because hardware and facilities still require protection.
4. Technological Controls
Technological controls focus on technical security mechanisms used to protect information systems and networks.
These controls include many of the security measures commonly associated with cybersecurity programs.
Examples include:
- Access control systems
- Authentication mechanisms
- Encryption and cryptography
- Network security controls
- Malware protection
- System monitoring and logging
- Backup and recovery procedures
- Vulnerability management
These controls are essential for protecting digital infrastructure and preventing cyberattacks.
Statement of Applicability (SoA)
A key requirement in ISO/IEC 27001 implementation is the Statement of Applicability.
The SoA is a document that lists:
- All Annex A controls
- Whether each control is implemented or excluded
- The justification for inclusion or exclusion
- The implementation status
The SoA demonstrates how the organization has addressed security risks using appropriate controls.
It is one of the most important documents reviewed during ISO/IEC 27001 certification audits.
How Organizations Select Annex A Controls
ISO/IEC 27001 uses a risk-based approach.
The process typically follows these steps:
- Identify information assets.
- Assess threats and vulnerabilities.
- Evaluate potential impacts.
- Determine risk levels.
- Select appropriate controls from Annex A.
This approach ensures that organizations implement security measures that match their specific risk environment rather than blindly applying all available controls.
Relationship Between ISO/IEC 27001 and ISO/IEC 27002
While ISO/IEC 27001 defines the requirements for an ISMS, ISO/IEC 27002 provides detailed guidance on how to implement the controls listed in Annex A.
In practice:
- ISO/IEC 27001 defines what must be done
- ISO/IEC 27002 explains how controls can be implemented
Organizations often use both standards together when building their security management framework.
Annex A Controls and Compliance Audits
During an ISO/IEC 27001 certification audit, auditors evaluate whether the selected controls have been properly implemented and maintained.
Auditors review:
- Risk assessment documentation
- Statement of Applicability
- Security policies
- Evidence of control implementation
- Monitoring and improvement processes
Organizations must demonstrate that the selected controls effectively reduce identified risks.
ISO/IEC 27001 Controls and Other Cybersecurity Standards
Annex A controls align with many other cybersecurity frameworks, including:
- NIST Cybersecurity Framework
- IEC 62443
- PCI DSS
This alignment allows organizations to integrate ISO/IEC 27001 with other regulatory and security requirements.
Benefits of Implementing Annex A Controls
Applying Annex A controls helps organizations:
- Reduce cybersecurity risks
- Protect sensitive information
- Improve security governance
- Meet regulatory requirements
- Build customer trust
- Prepare for security audits
Because the controls are widely recognized, they provide a strong foundation for building mature cybersecurity programs.
Final Thoughts
Annex A controls are the practical foundation of ISO/IEC 27001 implementation. By selecting appropriate controls based on risk assessments, organizations can build a comprehensive Information Security Management System that protects information assets and supports continuous improvement.
Understanding how these controls work—and how they align with organizational risks—is essential for successfully implementing ISO/IEC 27001 and achieving certification.