Annex A
Annex A is the reference list of controls at the back of ISO 27001: 93 controls in the 2022 edition, grouped into four themes. You check the controls your risk treatment needs against it and record each one, applied or excluded with a reason, in your Statement of Applicability. ISO 42001 has its own Annex A for AI.
- Clauses
- ISO 27001:2022 6.1.3 c) · ISO 27001:2022 6.1.3 d) · ISO 42001:2023 6.1.3
Where the term appears
In ISO 27001:2022 the themes are numbered 5 to 8: organisational (37 controls), people (8), physical (14) and technological (34). The 2013 edition grouped its controls into 14 domains, so old control numbers do not carry over. ISO 27001:2022 6.1.3 c) asks you to compare your controls with Annex A, and ISO 27001:2022 6.1.3 d) asks for a Statement of Applicability covering every one. ISO 42001:2023 6.1.3 works the same way against its own Annex A of 38 AI controls, with implementation guidance in its Annex B.
Normative, but not a to-do list
Annex A is normative: it is part of what you are audited against. That does not mean every control applies. An auditor tests that each exclusion has a reason tied to your risks or scope, and that each control marked implemented has evidence behind it. The organisational controls page shows how the largest theme breaks down.
How Sted uses it
- Sted keeps a Statement of Applicability for each adopted standard with a control catalogue.
- Only standards with a control catalogue get a Statement of Applicability card.
- For ISO 27001 Sted’s knowledge base carries 42 policies and procedures and 91 record templates tagged to its clauses and Annex A controls, and a Statement of Applicability over the 93 Annex A controls in four themes.
Related terms
- Statement of Applicability: the document that records your decision on each Annex A control.
- Control: one entry in Annex A.
- Risk treatment plan: how the chosen controls are put in place.
- ISMS: the management system Annex A serves.
- How to write a Statement of Applicability: the task, control by control.