The ISO 27001 Annex A Controls are not simply a checklist to be completed. They provide a structured reference framework for managing information security risk.
Protecting sensitive information requires more than implementing isolated security measures. ISO/IEC 27001:2022 provides a risk-based framework for managing information security, supported by the controls contained in Annex A.
Annex A includes 93 controls organised across four themes: Organisational Controls, People Controls, Physical Controls and Technological Controls.
These controls provide a recognised library of safeguards that organisations can select according to their identified risks.
Annex A is not a checklist that every organisation implements in full.
Every control should be considered, but applicability depends on the organisation’s risks, obligations, contractual requirements and business objectives.
The ISO 27001 Annex A Controls are not simply a checklist to be completed. They provide a structured reference framework for managing information security risk.
Effective information security is not measured by how many controls an organisation implements. It is measured by how effectively the selected controls address the organisation's actual information security risks.
When controls are selected through a structured Risk Assessment, documented in the Statement of Applicability and integrated into a continually improving Information Security Management System, Annex A can help organisations protect valuable information, strengthen governance, support certification and improve long-term organisational resilience.
The ISO 27001 Annex A Controls are a structured set of information security controls that organisations can use to treat identified information security risks within their Information Security Management System.
Published as part of ISO/IEC 27001:2022, Annex A contains 93 controls grouped into four categories:
These controls represent internationally recognised information security practices designed to help organisations protect the confidentiality, integrity and availability of their information.
However, Annex A is not a checklist that every organisation must implement in full. Instead, it serves as a reference catalogue of potential controls that organisations evaluate during the Information Security Risk Assessment and Risk Treatment process.
The controls selected should reflect the organisation's specific risks, business objectives, legal obligations and operational environment.
ISO/IEC 27001 consists of two complementary components:
The clauses establish what the Information Security Management System must achieve, while Annex A provides controls that can be used to manage specific information security risks.
Organisations are certified against the requirements of ISO 27001, not against Annex A itself.
The primary purpose of Annex A is to help organisations reduce information security risks by implementing appropriate safeguards.
These controls may be used to:
By selecting controls appropriate to identified risks, organisations can build an Information Security Management System that is proportionate, practical and aligned with their business objectives.
The ISO 27001 Annex A Controls provide organisations with a structured framework for implementing practical safeguards that protect information, reduce business risk and support the effectiveness of the ISMS.
They help organisations protect the three fundamental principles of information security:
Together, these principles form the foundation of an effective Information Security Management System.
ISO 27001 is built around risk management rather than prescriptive compliance.
Once an organisation has identified its information security risks, Annex A provides controls that can be used to reduce those risks to an acceptable level.
For example, controls can help organisations:
Annex A plays a central role in ISO 27001 certification.
During implementation, organisations review each of the 93 controls and determine whether it is applicable to their ISMS.
These decisions are documented in the Statement of Applicability, which records:
During certification audits, auditors use the Statement of Applicability to verify that control selection is based on the organisation's Information Security Risk Assessment and Risk Treatment process.
Many Annex A Controls focus on governance by helping organisations:
This helps ensure information security becomes part of normal business operations rather than remaining an isolated IT function.
Annex A does not replace legal or regulatory obligations, but appropriate controls can help organisations establish practices that support applicable requirements.
For South African organisations, this may include:
Annex A includes controls relating to:
Together, these controls help organisations prevent incidents where possible, respond effectively when they occur and recover more quickly from disruptions.
ISO/IEC 27001:2022 groups the 93 Annex A Controls into four themes.
Organisational Controls establish the governance framework for information security.
Examples include:
Business value: Organisational Controls create the governance structures needed to manage information security consistently, improve accountability and support informed decision-making.
People Controls help organisations manage information security risks associated with employees, contractors and other relevant parties.
Examples include:
Business value: People Controls reduce human-related information security risks by improving awareness, accountability and employee engagement.
Physical Controls focus on preventing unauthorised physical access to facilities, equipment and information assets.
Examples include:
Business value: Physical Controls reduce the likelihood of information loss, theft and operational disruption by protecting facilities, equipment and physical information assets.
Technological Controls protect information systems, networks, applications and digital information.
Examples include:
Business value: Technological Controls protect digital information and IT infrastructure from cyber threats while improving system reliability, resilience and operational continuity.
Organisations do not select controls simply because they appear in Annex A.
Control selection follows a structured, risk-based process.
Establish which business units, locations, products, services, information assets, technologies and processes are included within the Information Security Management System.
Identify and assess:
Without an effective Risk Assessment, there is no objective basis for selecting appropriate Annex A Controls.
Determine how each identified risk will be managed.
Risk treatment options typically include:
Where risk reduction is selected, Annex A provides potential controls that may be used.
Every control should be considered.
For each control, determine:
Reviewing every control does not mean implementing every control.
Control selection should consider:
The Statement of Applicability records:
This creates a transparent connection between identified risks and the controls used to manage them.
Implementation may involve:
Controls should be reviewed through:
As risks or business activities change, selected controls and the Statement of Applicability should be reviewed and updated where necessary.
ISO 27001 does not require every Annex A Control to be implemented.
Instead, organisations evaluate every control and determine whether it is applicable based on their Information Security Risk Assessment, Risk Treatment process and ISMS scope.
Where a control is excluded, the organisation should provide a clear justification within its Statement of Applicability.
Control applicability differs according to factors such as:
For example, controls relating to software development may not be applicable where an organisation does not develop software.
The important point is that an exclusion must be based on a considered and documented decision.
Implementing unnecessary controls can:
ISO 27001 encourages organisations to implement appropriate controls rather than the greatest possible number of controls.
Annex A is a catalogue of potential controls, not a mandatory implementation checklist.
The appropriate sequence is:
A weak Risk Assessment can result in:
The Risk Assessment should form the foundation of Annex A control selection.
Templates can provide a useful starting point, but every organisation has different:
The Statement of Applicability and Annex A implementation should therefore reflect the organisation's actual operating environment.
Every selected control should have a clear purpose linked to an identified risk, legal requirement, contractual obligation or business objective.
A meaningful justification explains why the control matters to the organisation, not simply that it is being implemented for certification.
An effective ISMS requires Organisational, People, Physical and Technological Controls to work together.
Technology alone cannot create an effective Information Security Management System.
Each Annex A Control should have clear ownership for its implementation, monitoring, review and maintenance.
Without accountability, controls can become outdated or inconsistently applied.
The following should form a logical and consistent chain:
Inconsistencies between these elements can create problems during certification audits and weaken the effectiveness of the ISMS.
Information security risks change.
Controls should therefore be reviewed regularly through Risk Assessments, Internal Audits, Management Reviews, incident investigations, corrective actions and organisational change.
Effective implementation can help organisations achieve:
The value of Annex A therefore extends beyond certification.
When implemented properly, the controls become part of how the organisation manages information security risk and protects its operations.
Implementing Annex A Controls requires more than selecting security measures from a list.
ISO Specialist South Africa helps organisations develop practical, risk-based Information Security Management Systems aligned with their risks, business objectives and certification goals.
Support can include:
Our implementation methodology includes:
This helps ensure selected Annex A Controls are connected to identified business risks and supported by appropriate evidence.
Every organisation operates differently.
Before the external certification audit, support can include:
ISO 27001 certification is not the end of the process.
Ongoing support may include:
ISO 27001 Annex A Controls are a catalogue of 93 information security controls included in ISO/IEC 27001:2022. They provide organisations with a framework for treating information security risks identified during the Risk Assessment process.
No. Every control should be evaluated, but organisations implement controls according to their risks and other applicable requirements. Exclusions should be justified within the Statement of Applicability.
There are 93 controls:
ISO 27001 contains the requirements for establishing, implementing, maintaining and continually improving an Information Security Management System.
Annex A provides the reference set of information security controls organisations consider when treating identified risks.
The Statement of Applicability records which Annex A Controls have been selected, which have been excluded, the reasons for those decisions and the implementation status of applicable controls.
Controls are selected through a structured process involving ISMS scope definition, Risk Assessment, Risk Treatment, consideration of the Annex A Controls and documentation within the Statement of Applicability.
The 2022 version reduced the control set from 114 to 93 and reorganised the controls from 14 domains into four themes.
It also introduced controls addressing areas such as threat intelligence, cloud services, secure coding and data masking.
Yes. ISO 27001 can be applied by organisations of different sizes.
The focus is on implementing controls appropriate to the organisation's risks and operating environment rather than implementing the greatest number of controls.
ISO 27001 certification does not automatically demonstrate POPIA compliance.
However, controls relating to areas such as access control, encryption, information classification, incident management, supplier security, backup and monitoring can support broader practices used to protect personal information.
Controls should be reviewed regularly and when significant changes occur.
Reviews may take place during Risk Assessments, Internal Audits, Management Reviews, following information security incidents and before surveillance or recertification audits.
Certification auditors assess whether the organisation has considered the Annex A Controls, selected appropriate controls, justified exclusions, documented its decisions and effectively implemented applicable controls.
Annex A is only one part of developing and maintaining an effective Information Security Management System.
Related resources include:
ISO Specialist South Africa helps organisations across South Africa:
If you're implementing ISO 27001, preparing for certification or reviewing an existing Information Security Management System, we can help you develop a practical approach aligned with your organisation's risks, operational requirements and certification objectives.