Request a callback

Glossary · ISO/IEC 27001:2022 · Annex A

Annex A (ISO 27001)

Definition

ISO/IEC 27001:2022 · Annex A

The normative list of 93 reference information security controls in ISO/IEC 27001:2022, grouped into four themes: organisational (37), people (8), physical (14) and technological (34). You do not have to implement all of them; you compare your risk treatment against the list to check nothing is missing and record the result in the Statement of Applicability. ISO/IEC 27002:2022 gives implementation guidance for each control.

Also called reference controlsISO 27002 controls
Read the source

Source: ISO/IEC 27001:2022

In other laws

LawTermNote
ISO/IEC 42001Annex A (ISO 42001)38 AI-specific controls in the same role, selected through risk treatment and justified in a Statement of Applicability.
SOC 2 (AICPA)Trust Services CriteriaCriteria describe outcomes and leave the controls to you; Annex A is a list of controls.

Where it appears

Annex A

Information security controls reference

cl. 6.1.3 c)

Compare the controls you determined with Annex A

Related terms

Statement of ApplicabilityAnnex A (ISO 42001)Risk treatment planInformation security management system (ISMS)

This page explains the law in plain English. It is not legal advice.