# Annex A

The reference list of controls at the back of ISO 27001, 93 in the 2022 edition, that every Statement of Applicability is checked against.

Source: https://sted.digital/docs/glossary/annex-a · Last reviewed 17 October 2026 · Strand Glossary

Annex A is the reference list of controls at the back of ISO 27001: 93 controls in the 2022 edition, grouped into four themes. You check the controls your risk treatment needs against it and record each one, applied or excluded with a reason, in your Statement of Applicability. ISO 42001 has its own Annex A for AI.

## Where the term appears

In ISO 27001:2022 the themes are numbered 5 to 8: organisational (37 controls), people (8), physical (14) and technological (34). The 2013 edition grouped its controls into 14 domains, so old control numbers do not carry over. ISO 27001:2022 6.1.3 c) asks you to compare your controls with Annex A, and ISO 27001:2022 6.1.3 d) asks for a Statement of Applicability covering every one. ISO 42001:2023 6.1.3 works the same way against its own Annex A of 38 AI controls, with implementation guidance in its Annex B.

### Normative, but not a to-do list

Annex A is normative: it is part of what you are audited against. That does not mean every control applies. An auditor tests that each exclusion has a reason tied to your risks or scope, and that each control marked implemented has evidence behind it. The [organisational controls page](/docs/standards/iso-27001/annex-a-organisational-controls) shows how the largest theme breaks down.

## How Sted uses it

Sted keeps a Statement of Applicability for each adopted standard with a control catalogue.
Only standards with a control catalogue get a Statement of Applicability card.
For ISO 27001 Sted's knowledge base carries 42 policies and procedures and 91 record templates tagged to its clauses and Annex A controls, and a Statement of Applicability over the 93 Annex A controls in four themes.

## Related terms

- [Statement of Applicability](/docs/glossary/statement-of-applicability): the document that records your decision on each Annex A control.
- [Control](/docs/glossary/control): one entry in Annex A.
- [Risk treatment plan](/docs/glossary/risk-treatment-plan): how the chosen controls are put in place.
- [ISMS](/docs/glossary/isms): the management system Annex A serves.
- [How to write a Statement of Applicability](/docs/guides/statement-of-applicability): the task, control by control.