ISO/IEC 27001 is the standard for building and operating an Information Security Management System (ISMS). Annex A is the section that lists a set of information security controls you can use to address risks.
Annex A supports a key requirement: you must define your control set and document it in the Statement of Applicability (SoA). The SoA shows which controls you selected, which you excluded, and the justification for each decision.
Annex A aligns closely with ISO/IEC 27002, which provides implementation guidance for controls. If ISO 27001 is the management system, ISO 27002 is the how-to playbook for running many of the controls in practice.
You do not need to implement every control in ISO 27002. You need to implement the controls that treat the risks in your scope, and be able to prove they operate as described.
If you are pursuing ISO 27001 certification, you will need to address Annex A. It applies to organizations of all sizes, especially:
Annex A covers a wide range of security topics. Auditors expect to see both governance and technical control operation, depending on your scope and risks.
Common control themes include:
Annex A audits rely on evidence that a control is implemented and operating. Auditors typically sample evidence across teams, systems, and time periods.
Common evidence includes:
Rule of thumb: If you cannot show the evidence trail, the control is not really operating.
Confirm what products, services, locations, and systems are in scope. Define interested parties and obligations.
Identify and evaluate risks that apply to your scope. This drives which Annex A controls apply.
Choose Annex A controls that treat identified risks. Document inclusions and exclusions with justification.
Translate controls into procedures, tooling, and consistent operating rhythms. Assign ownership.
Collect evidence as you operate. Run internal audits and management review before the certification audit.
We help you translate Annex A into a control operating model that fits your business. That means selecting the right controls, documenting the SoA, implementing what matters, and building evidence that auditors trust.
Since 2017, we have maintained a 100% audit success rate across more than 700 successful audits and assessments.
No. You need to select controls based on risk and scope, and justify exclusions in your SoA.
They are related. Annex A lists control topics. ISO 27002 provides detailed guidance on implementing many controls.
Auditors often start with scope, risk assessment, the SoA, and whether evidence aligns with your documented approach.
Focus on scope clarity, strong ownership, and evidence routines. Implement controls that reduce risk and support your buyers.
If you want help mapping Annex A to your scope, selecting controls, and building evidence that supports certification, we can walk through it with you.