ISO 27001 Annex A Controls are the security measures an organisation chooses to reduce information risk and support its information security management system. They cover governance, access control, cryptography, operations, supplier security, incident response, and resilience. In practice, they form a risk-based control set used to protect confidentiality, integrity, and availability.
What ISO 27001 Annex A Controls Are For
iso 27001 annex a controls are the selectable security measures an organisation uses to treat information risk within its ISMS. They are not a fixed checklist, but a risk-based control set chosen to support confidentiality, integrity, and availability.
The practical point is that Annex A gives organisations a structured way to justify why particular safeguards are in scope. That makes it easier to connect risk assessment, control selection, and the Statement of Applicability without treating every possible safeguard as mandatory.
How Annex A Fits Into the ISO 27001 Control Model
Annex A sits alongside the ISO 27001 management system requirements, so the standard does not just ask whether a control exists, but whether it is relevant to the organisation’s risks. The controls are therefore part of governance as much as technical security.
That distinction matters because two organisations can both be compliant while using different control sets. One may rely more heavily on supplier assurance, another on stronger cryptography or tighter privileged access, depending on its assets, threats, and regulatory context.
For that reason, Annex A should be read as a control catalogue for risk treatment, not as a universal minimum baseline. The companion guidance in ISO/IEC 27002:2022 Information Security Controls explains how those controls are meant to be interpreted and implemented.
Common Control Families in Annex A
Annex A spans governance, people, physical, and technological controls. In practice, that means it covers topics such as access control, asset handling, logging, cryptography, secure development, supplier security, incident handling, and continuity planning.
Some controls are preventive, such as limiting privileged access or hardening cloud and system configurations. Others are detective or responsive, such as monitoring logs, handling incidents, or preserving evidence after an event. A strong ISMS usually needs a blend of all three.
Because Annex A is risk-based, the right question is not “Which controls are listed?” but “Which controls reduce the most important risks for this environment?” That is why the control set often changes when the business model, supplier chain, or technology stack changes.
For a full control overview and implementation context, the ISO 27002 Controls Guide is the most direct companion reference, while the ISO/IEC 27001:2022 Information Security Management standard defines how those controls support the wider ISMS.
Why Annex A Is Used for Evidence, Scope, and Assurance
Annex A becomes especially important when organisations need to explain security decisions to auditors, customers, regulators, or internal stakeholders. It gives a common structure for evidence, scope boundaries, and control rationale.
That is why many programmes use Annex A as a bridge between risk treatment and assurance activities. It helps show not only that controls exist, but that they are selected, owned, reviewed, and tied to documented risk decisions.
Where organisations manage multiple compliance obligations, Annex A can also serve as a control anchor for mapping. The value is not just passing an audit, but reducing duplicated work by aligning one control set with several assurance needs.
For that reason, the broader mapping and certification journey is often handled through materials such as the ISO 27001 Certification Guide and the Control Mapping Guide, which help practitioners connect Annex A to evidence and cross-framework reporting.
Risk and Threat Considerations
Annex A reduces risk only when the selected controls match the real threat model. The main failure mode is under-scoping, where a control set looks complete on paper but leaves gaps in access, supplier reliance, logging, incident readiness, or resilience.
Failure mechanism: If organisations treat Annex A as a generic checklist, they can miss important dependencies and inherit exposure from weak implementation, stale scope decisions, or controls that exist without operational ownership.
Impact: That can leave confidentiality, integrity, and availability exposed even when the ISMS appears mature, and it can undermine audit confidence, incident recovery, and customer trust.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
ISO/IEC 27001:2022 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| ISO/IEC 27001:2022 | A.5.15 — Access Control | Annex A controls govern access decisions and control selection in the ISMS. |
| A.8.24 — Use of Cryptography | Annex A includes cryptographic controls as part of risk treatment for information protection. | |
| A.5.23 — Information security for use of cloud services | Annex A covers cloud-use controls when cloud dependencies affect the ISMS risk profile. | |
| Recommendation — Map access risks to A.5.15 and document the control rationale in the Statement of Applicability. Select A.8.24 where cryptography materially reduces confidentiality or integrity risk. Apply A.5.23 when cloud services change the organisation’s security and assurance requirements. | ||
Practitioner Guidance
Governance implication: Treat Annex A as a decision record, not a static catalogue. Each selected control should have a clear risk rationale, owner, and review cycle so the control set stays aligned to current business conditions.
What to watch for: Pay close attention when the environment changes, especially after cloud migrations, supplier changes, major incidents, or new regulatory commitments. Those events often require the control set and the Statement of Applicability to be revisited.
Practitioner takeaway: Annex A is strongest when it is used to explain why controls were chosen, not merely to prove that they were listed.
Related resources from NHI Mgmt Group
- How should organisations decide which ISO 27001 Annex A controls apply?
- How should security teams implement identity controls to meet ISO 27001 Annex A.9 and similar access governance requirements?
- What is the difference between the ISO 27001 mandatory clauses and Annex A controls?
- Why do access controls matter so much in ISO 27001 Annex A?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org