What is the difference between the ISO 27001 mandatory clauses and Annex A controls?

What the Clauses Do That Annex A Does Not

The mandatory clauses are the management system requirements that make ISO 27001 a certifiable standard. They define how the organisation establishes scope, leadership, planning, support, operation, performance evaluation and improvement. Annex A does not replace those requirements, it sits beside them as the control catalogue used to choose security controls that fit the organisation’s context and risk treatment decisions.

That distinction matters because a company can have a long control list and still fail ISO 27001 if the clauses are weak. The clauses are about governing the system, proving it works and showing continual improvement. Annex A is about control selection, not about the governance mechanics that make the system auditable.

For the standard itself, see ISO/IEC 27001:2022 Information Security Management. Its structure is what turns ISO 27001 into an ISMS standard rather than a simple checklist of safeguards.

How Annex A Fits into the Statement of Applicability

Annex A is best understood as the reference set the organisation uses when deciding which controls are needed, which are excluded, and why. The decision belongs in the Statement of Applicability, where the business records which controls are relevant to its risks, operations and obligations. That is why Annex A is informative, not mandatory in the same way the clauses are.

The practical test is whether the organisation can explain its control choices coherently. If a control is omitted, there should be a clear rationale tied to risk, scope or operating model, not just preference. If a control is included, the organisation should be able to show how it supports treatment of identified risk and how it is operated in practice. The ISO 27001 Statement of Applicability Template is useful here because it shows how Annex A decisions are documented and reviewed.

For control guidance and implementation detail, ISO/IEC 27002:2022 Information Security Controls is the companion reference. Annex A names the control topics, while ISO 27002 explains how those controls are interpreted and applied.

Why the Difference Matters in Audits and Real Operations

Auditors usually look for two different things. First, they expect the clauses to show that the ISMS exists, has governance, has undergone risk assessment and is being reviewed and improved. Second, they expect Annex A and the SoA to show that the chosen controls are sensible for the risks and that exclusions are justified. A sound Annex A choice cannot rescue a weak ISMS, and a good ISMS still needs credible control selection.

That is why implementation teams should not treat Annex A as a mandatory fixed list. The catalogue is broad enough to support different environments, but the final control set should still reflect the organisation’s scope, risk appetite and technology stack. The point is not to “implement everything”, it is to select, justify and operate the controls that actually reduce the assessed risk.

Risk and Threat Considerations

The main risk is confusing certification evidence with control effectiveness. Organisations sometimes overfocus on ticking off Annex A items and underinvest in the clauses that make the ISMS governable, reviewable and adaptable. That creates a paper-compliant system with weak operational assurance.

Failure mechanism: The SoA lists controls without a defensible link to risk treatment, or the ISMS process exists on paper but does not produce consistent review, ownership and improvement.

Impact: Audits become harder to pass credibly, control gaps persist because no one can explain why a control was chosen or excluded, and the organisation may carry unmanaged security exposure despite appearing compliant.

Practitioner Guidance

What to verify: Check that the clauses are evidenced through scope, policy, risk assessment, internal audit, management review and corrective action, then confirm that Annex A selections are tied back to that risk treatment logic. If the SoA reads like a generic control inventory, it is usually too weak.

Decision rule: If you are trying to determine compliance, start with the clauses and the ISMS evidence chain; if you are trying to determine what security controls to implement, use Annex A as the catalogue and ISO 27002 as the implementation guide. Do not let control selection replace system governance.

Practitioner takeaway: ISO 27001 compliance is earned by proving the management system works, while Annex A shows how that system is translated into a risk-based control set; confusing the two is one of the most common implementation errors.

Related resources from NHI Mgmt Group

• Guide: ISO 27002 Controls Guide
• Annex A Controls
• How should organisations decide which ISO 27001 Annex A controls apply?
• How should security teams implement identity controls to meet ISO 27001 Annex A.9 and similar access governance requirements?
• Why do access controls matter so much in ISO 27001 Annex A?