Glossary · Information security
Annex A Controls
The catalogue of information security controls in ISO/IEC 27001, grouped into organisational, people, physical, and technological themes.
Put the term into practice: ISMS software
Annex A of ISO/IEC 27001 is a reference catalogue of controls that organisations draw on to treat their information security risks. The 2022 revision organizes the controls into four themes: organisational, people, physical, and technological.
Annex A is not a checklist to apply in full. Organisations select the controls that are relevant to their risks and record the decision in the Statement of Applicability. Detailed implementation guidance for each control lives in ISO/IEC 27002.
