That approach misses the point. The real work is figuring out which controls actually address your organization's information security risks, and being able to prove why you made those choices.
For US organizations, the stakes are concrete. You're protecting sensitive customer and defense-related data, meeting contractual security clauses, keeping operations running after an incident, and producing evidence an auditor will actually accept. Get the selection process wrong, and you either overbuild (wasting budget on controls that don't match your risk) or underbuild (leaving gaps an auditor will flag).
This article walks through a practical framework: understand the 2022 control structure, connect your risks to applicable controls, document the decisions in your Statement of Applicability, and verify the controls actually work day to day.
Key Takeaways
- Annex A in ISO/IEC 27001:2022 contains 93 controls across four themes; always confirm current terminology against an authoritative source
- Controls get selected through risk assessment and treatment, not blanket implementation
- The Statement of Applicability must document applicability, justification, status, and exclusions
- Effective controls need named owners, documented evidence, and regular review
- Exclusions require a defensible rationale tied to your actual risk assessment, not convenience
What Are ISO 27001 Controls?
An ISO 27001 control is a safeguard, process, policy, or technical measure that reduces information security risk within your Information Security Management System (ISMS). That's the whole definition. It can be as simple as a background-check policy or as technical as network segmentation rules.
Two parts of the standard get conflated often:
- Clauses 4-10 define the management system requirements, meaning how you plan, operate, and improve your ISMS
- Annex A is a reference list of controls you draw from during risk treatment
ISO/IEC 27002 sits alongside the standard as implementation guidance. It explains how to apply each Annex A control in more detail, but it isn't itself a certifiable standard. In short, 27001 defines what you must do; 27002 shows how you might do it.
Annex A controls exist to protect confidentiality, integrity, and availability of information, while also satisfying legal, regulatory, contractual, and operational requirements specific to your business.
The Shift from 2013 to 2022
The control framework changed substantially in the latest revision. The 2013 edition organized 114 controls into 14 domains. The current edition condenses that into 93 controls across four themes, according to IAF's transition guidance.
Fewer controls doesn't mean fewer obligations. Several older controls were merged, several were rewritten, and eleven are entirely new. Organizations still certifying under the 2013 edition needed to complete their transition by October 31, 2025, a deadline that has already passed.
Control Themes in ISO/IEC 27001:2022
The four themes replace the old domain structure and give a broader view of security responsibility. Under this model, security spans governance, people, facilities, and technology, not IT alone.
| Theme | Control Count | Focus |
|---|---|---|
| Organizational | 37 | Governance, policy, risk, supplier, compliance |
| People | 8 | Hiring, training, insider risk |
| Physical | 14 | Facilities, equipment, environmental threats |
| Technological | 34 | Systems, networks, cryptography, code |
Organizational Controls
These cover governance, policy, asset and access management, supplier security, incident response, business continuity, and compliance. Because they touch policy and process rather than a single system, they need leadership sign-off and cross-functional ownership, not just an IT ticket.
People Controls
People controls include:
- Pre-hire screening and clear employment terms
- Security awareness training and disciplinary processes
- Post-employment duties and confidentiality agreements
- Remote work rules and security event reporting
They matter because human error and insider risk drive a large share of real incidents, no matter how strong your firewalls are.
Physical Controls
Secure areas, equipment protection, environmental monitoring, clear-desk practices, media handling, and disposal procedures protect information that lives outside your network. A locked server room matters just as much as encryption when a laptop walks out the door.
Technological Controls
This theme covers access management, authentication, secure configuration, vulnerability management, malware defense, backups, logging, monitoring, network security, cryptography, secure development, and change management. It is the largest group by count and the one most teams still treat as classic cybersecurity.
The 11 New Controls in the 2022 Edition
SGS's 2022 analysis identified eleven additions, split across three organizational, one physical, and seven technological controls:
- Threat intelligence
- Information security for use of cloud services
- ICT readiness for business continuity
- Physical security monitoring
- Configuration management
- Information deletion
- Data masking
- Data leakage prevention
- Monitoring activities
- Web filtering
- Secure coding
Notice the pattern: cloud usage, data leakage, secure development, configuration drift, and continuous monitoring all got dedicated attention. These reflect how attack surfaces actually changed over the past decade, and they deserve specific review during any gap assessment.
Why the Control Count Doesn't Determine the Implementation Plan
The 93-control figure is a reference catalog, not a universal target. Your scope, your assets, your technology stack, your suppliers, your locations, and your legal obligations determine what's actually appropriate. A five-person SaaS startup and a 2,000-person defense contractor will land on very different Statements of Applicability, even though both reference the same Annex A.
Three distinct things happen during implementation, and they're easy to conflate:
- Selecting a control (deciding it applies to your risk profile)
- Defining how you'll implement it (the actual policy, process, or tool)
- Maintaining evidence that it operates as intended
Selection also means deciding what to leave out. An exclusion is fine, but only when it's defensible. "We don't use cloud services, so A.5.23 doesn't apply" works if it's true and documented. "This control is inconvenient" doesn't hold up under audit scrutiny.
For every control you keep, auditors expect evidence it actually operates:
- Approved policies and procedures
- Access review logs
- Training completion records
- Supplier security assessments
- System configuration baselines
- Incident response records
- Backup restoration test results
- Monitoring and management review reports
Selecting and Applying Annex A Controls: A 6-Factor Framework
Selection works best as a sequence that connects your business context to practical safeguards. Copying a generic control list from a template creates unnecessary work in low-risk areas while missing the risks that actually matter to your organization.
Factor 1: Define the ISMS Scope and Information Assets
Your ISMS scope determines which systems, processes, facilities, people, suppliers, and data need protection. Without a clear scope, you can't select controls intelligently; you're guessing.
Build an asset inventory first. Map data flows, system boundaries, and ownership. This step sounds basic, but skipping it is one of the most common reasons organizations select controls that don't protect anything specific.
Factor 2: Assess Threats, Vulnerabilities, Impacts, and Obligations
Identify realistic threats, not theoretical ones. Then weigh potential business impact alongside legal, regulatory, customer, and contractual requirements.
Here's how one risk cascades into multiple control decisions. Say your risk assessment flags ransomware exposure. Verizon's 2026 DBIR found ransomware present in 48% of all breaches in its dataset.
That single risk might trigger controls around backup testing, malware defense, network segmentation, incident response, and employee awareness training, all at once.
Factor 3: Map Risks to Controls and Evaluate Applicability
Build a simple mapping table that captures:
- The risk
- Your treatment objective
- The selected Annex A control
- The responsible owner
- Implementation approach
- Residual risk after treatment
Watch for two failure modes:
- Under-controlling, where real risks go unaddressed
- Overengineering, where you deploy heavyweight controls for low-impact risks
If you're mapping from NIST 800-171, CMMC, or another framework, use it as a reference, not proof of ISO 27001 conformity. The frameworks overlap but aren't identical.
Factor 4: Prepare and Maintain the Statement of Applicability
Your SoA needs to communicate four things clearly:
- Which controls apply
- Why you selected or excluded each one
- Whether each control is implemented
- Where the supporting evidence lives
The SoA should agree with your risk assessment, treatment plan, policies, and actual operating practices. If your SoA says a control is implemented but nobody can produce evidence, that's a finding waiting to happen. Treat it as a living document, reviewed whenever scope, systems, suppliers, or obligations change.
Factor 5: Assign Ownership and Apply Controls Across Departments
Responsibility shouldn't sit entirely with IT. Spread it across IT, security, HR, legal, procurement, facilities, and leadership based on each control's purpose.
Assign one accountable owner per control, plus supporting teams and a review cadence. For example, pair IT with HR on joiner-mover-leaver access processes, since one team manages accounts and the other manages employment status changes. Pair procurement with security on supplier requirements for the same reason.
Factor 6: Verify Operation, Evidence, and Continual Improvement
Having a policy and proving the process operates consistently are two different things. Auditors expect to see both.
Track metrics relevant to your selected controls:
- Access review completion rates
- Vulnerability remediation timelines
- Backup restoration test results
- Training completion percentages
- Incident response exercise outcomes
- Supplier review status
Internal audits, management reviews, incidents, and corrective actions all feed back into whether a control remains suitable. Revisit each control when scope, systems, or residual risk changes.
Common Mistakes When Applying Annex A Controls
A few patterns show up repeatedly in failed audits:
- Implementing controls before scope and risk assessment are finished
- Selecting controls because a template included them, not because risk analysis supported them
- Assuming a technical tool alone satisfies a control's full intent
- Excluding controls without documented, risk-based justification
- Letting evidence go stale while policies stay unchanged on paper
- Leaving control ownership unclear across departments
Before your next audit, run a simple check: do your SoA, risk register, policies, procedures, evidence, and actual employee practices all tell the same story? If any of those disagree, that's your gap to close first.
How QMS Learning Can Help
Selecting and applying Annex A controls takes more than reading the standard once. It requires people who can interpret a control, apply it to a specific scenario, and produce evidence an auditor accepts.
QMS Learning builds training around that exact gap. The Defense Cybersecurity Readiness pathway covers ISO 27001 alongside CMMC, NIST 800-171, and SOC 2, which defense contractors often run in parallel.
The pathway is in pilot for Q3 2026, so check current availability before enrolling a team.
Platform features that support this workflow:
- AI Workbench and Method Router walk teams through control interpretation and method selection for each scenario
- Manager Dashboard tracks capability gaps and training outcomes you can show in an audit
- Document Management System keeps clause-mapped, revision-tracked records instead of scattered shared-drive files
None of this replaces risk ownership, executive decision-making, or independent certification audits. QMS Learning trains the people who do that work and helps them organize the evidence.
Conclusion
Selecting ISO 27001 controls is a business-risk decision. Match each control to real risks in your environment and keep the justification clear. The same sequence applies at any company size:
- Define your scope and understand your assets and risks
- Select and justify controls, then document them in the SoA
- Assign real owners and implement the safeguards
- Collect evidence and review whether the controls are working
Revisit your control selection after major changes: new suppliers, new technology, security incidents, or shifts in legal and contractual obligations. Annex A isn't a one-time exercise. It's a reference you return to as your business changes.
Frequently Asked Questions
Can you explain ISO 27001 in a simple way?
ISO 27001 is a requirements standard for building, running, reviewing, and continually improving an Information Security Management System. It uses risk-based controls from Annex A to address specific threats to your organization's data.
What are the 93 controls in ISO 27001 Annex A?
ISO/IEC 27001:2022 Annex A contains 93 reference controls grouped into four themes: organizational, people, physical, and technological. For exact wording of each control, consult the official standard or a verified control list from your certification body.
What are the four categories of controls in ISO 27001?
The four themes are organizational (governance and policy), people (human risk and training), physical (facilities and equipment), and technological (systems and networks). Each addresses a distinct category of risk to information security.
What are the 11 new controls in ISO 27001?
The 2022 edition added 11 controls: threat intelligence, cloud services security, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding. They target cloud and data-exposure risks the 2013 edition covered less directly.