Annex A is the control catalogue at the back of ISO 27001, 93 controls, reorganised in the 2022 revision into four themes. It's the part of the standard teams find most intimidating, and the part where automation helps most. Here's how to read it.
What Annex A is (and isn't)
Annex A is a menu, not a mandate. You select controls based on your risk assessment, and justify every inclusion and exclusion in your Statement of Applicability. An auditor doesn't expect all 93 implemented; they expect your selection to be defensible.
The four themes
A.5, Organisational (37 controls)
The management layer: policies, roles, supplier security, incident management, legal and regulatory compliance, and cloud services. This is where most of the documentation lives, and where AI drafting saves the most time.
A.6, People (8 controls)
Screening, terms of employment, security awareness training, disciplinary process, and responsibilities after termination. Evidence here is about your HR workflow actually running, onboarding checklists completed, training tracked to completion.
A.7, Physical (14 controls)
Offices, equipment, and media. For a remote-first startup, many of these scope down dramatically, but "scoped down" still needs a documented justification, not a shrug.
A.8, Technological (34 controls)
The engineering layer: access rights, authentication, malware protection, backups, logging, vulnerability management, secure development, and network security. This is where tool integrations earn their keep, the evidence is in your cloud consoles, and collecting it by hand is the classic audit-week nightmare.
The 2022 changes, briefly
The 2022 revision merged the old 114 controls into 93, grouped them into the four themes above, and added 11 genuinely new controls, including threat intelligence, cloud services security, data leakage prevention, and secure coding. If you see a guide organised into 14 domains, it's describing the 2013 edition; audits today run against 2022.
One control can satisfy requirements in multiple frameworks. A well-mapped access-control implementation earns credit in ISO 27001, GDPR, and a SOC 2, simultaneously.
Working through them without drowning
- Start from risks, not controls. The register tells you which controls matter; the catalogue is just where you shop.
- Map, don't duplicate. Each control should point at real things: a policy section, a tool configuration, a recurring task.
- Automate the evidence per control. A control without an evidence source will be "implemented" in name only by month six.
- Let the Statement of Applicability be generated. It's a mapping document, exactly what software is for. Here's how it works.
Certixa ships all 93 controls pre-mapped: the AI scopes each one to your business, drafts the justification, links the evidence source, and keeps the whole catalogue current as your company changes.