Annex A is the part of ISO/IEC 27001 that people open first and understand last. It looks like a checklist — 93 numbered controls with short titles — and it is treated like one by most first-time implementers, who work down it ticking boxes. It is not a checklist. It is a reference set that the standard asks you to compare your own risk-based control selection against, so that nothing necessary is missed, and the document that records the comparison is the Statement of Applicability. Read that way, Annex A becomes far more useful: a map of the whole territory of information security, organised so that a non-specialist can see where the gaps are.
This article walks the 2022 Annex A theme by theme in plain English — what each group of controls is for, which controls matter most for a 50-to-500-person organisation, and where the eleven new controls landed — then explains how the 2013 edition's 114 controls became these 93, and what the attribute tags on each control are for. Every control named here has its own page in the Clause Explorer with what it asks, what auditors look for, evidence, how to comply and the common nonconformities; the free A3 quick reference at the end puts all 93 on one page.
A note on sources. Control titles are the reference names from ISO/IEC 27001:2022 Annex A; everything else here is a plain-English paraphrase and reproduces no standard text. Work from your licensed copies of ISO/IEC 27001:2022 and ISO/IEC 27002:2022 — the second is where the implementation guidance for each control lives. Qlause is an independent training and templates provider, not a certification body.
First, what Annex A is for
Clause 6.1.3 of the standard sets the sequence: assess your risks, choose how to treat each one, determine the controls that treatment needs, and then compare those controls with Annex A to verify that no necessary control has been overlooked. Annex A is explicitly described as a list of possible controls, not an exhaustive one, and you may add controls from any other source. The Statement of Applicability then records every necessary control, why it is included, whether it is implemented, and why any Annex A control was excluded. The SoA article covers that document in detail; what follows is the content of the annex itself.
One consequence is worth stating plainly for ISO 9001 practitioners. Roughly two thirds of the 93 controls are not technical. They are policies, roles, registers, contracts, training, physical security and procedures — management-system work that a quality manager already knows how to do. The technological theme is where IT lives, and even there most controls are about governance of technology rather than configuration of it.
A.5 Organizational — 37 controls
The largest theme is the management-system backbone of the annex, and it breaks into seven natural groups.
Governance (5.1 to 5.8). Policies for information security — the top-level policy and the topic policies beneath it; roles and responsibilities; segregation of duties; management responsibilities; contact with authorities, which in South Africa means knowing in advance who notifies the Information Regulator under POPIA section 22; contact with special interest groups; threat intelligence, new in 2022, which asks you to collect and use information about the threats you actually face; and information security in project management.
Assets and information handling (5.9 to 5.14). The inventory of information and other associated assets with an owner for every entry — the raw material of the risk assessment; acceptable use rules; return of assets when people leave; classification and labelling of information; and the rules for transferring information inside and outside the organisation.
Access (5.15 to 5.18). The policy-level half of access control: the access control rules, identity management across the joiner-mover-leaver life cycle, the handling of passwords and other authentication information, and the provisioning and periodic review of access rights. The technical half sits in A.8.
Suppliers and cloud (5.19 to 5.23). Security in supplier relationships, the security terms that belong in supplier agreements (POPIA's operator contracts under sections 20 and 21 land here), the ICT supply chain, monitoring and review of supplier services, and — new in 2022 — information security for use of cloud services, which governs how you buy, use, manage and leave the cloud platforms most of your information now sits in.
Incidents (5.24 to 5.28). Planning and preparation, assessing and deciding on events, response, learning from incidents, and the collection of evidence. For South African organisations this group is where the POPIA section 22 breach-notification route must be worked out in advance — and where it is worth knowing that section 54 of the Cybercrimes Act, the 72-hour reporting duty for communications providers and financial institutions, had still not been proclaimed at the time of writing.
Continuity (5.29 and 5.30). Information security during disruption, and — new in 2022 — ICT readiness for business continuity: the recovery objectives, the plans and the tests that decide whether a ransomware attack or a flooded server room is survivable. Load-shedding made this control concrete for every South African site.
Legal, compliance and assurance (5.31 to 5.37). The register of legal, statutory, regulatory and contractual requirements; intellectual property; protection of records (POPIA section 14 on retention is the local anchor); privacy and protection of PII, which is where POPIA as a whole meets the ISMS; independent review of information security; compliance checks against your own policies; and documented operating procedures. The last three are the natural home of your internal audit programme, and the Audit Manager treats them that way.
A.6 People — 8 controls
The smallest theme is HR's share of information security, from before someone joins to after they leave. Screening before employment, done lawfully and in proportion to the role; security terms in the employment contract; awareness, education and training for everyone — the control behind every security-awareness programme, and the one POPIA Regulation 4(1)(e) and the FSCA/PA Joint Standard 2 of 2024 both point at; a disciplinary process that still meets the Labour Relations Act; responsibilities that continue after termination or a change of role; confidentiality agreements; remote working; and information security event reporting, the control that makes the whole system work, because an organisation whose people report suspicious emails within minutes has a security posture that no technology can buy.
A.7 Physical — 14 controls
The site's share. Physical security perimeters and entry controls; securing offices, rooms and facilities; physical security monitoring, new in 2022, which makes the camera and alarm coverage you probably already have an explicit control with retention and review; protection against physical and environmental threats — fire, flood, power, and in South Africa the power instability and cable theft that make supporting utilities a live risk rather than a formality; working in secure areas; clear desk and clear screen; equipment siting and protection; security of assets off-premises; storage media across its whole life; cabling; equipment maintenance; and secure disposal or re-use of equipment, where data on a decommissioned laptop or copier hard drive is destroyed verifiably. Manufacturing sites and warehouses should read this theme with the shop floor in mind, not just the office: the shared terminal by the line, the USB stick that carries machine programmes, and the dispatch door propped open in summer are all in scope.
A.8 Technological — 34 controls
The largest technical theme, and the one that benefits most from reading it as groups rather than 34 items.
Endpoints, access and authentication (8.1 to 8.5). User endpoint devices — laptops, desktops, phones — with encryption, configuration and updates; privileged access rights, the administrator accounts that every ransomware group wants; information access restriction; access to source code; and secure authentication, which in 2026 means multi-factor authentication on anything that matters. In Sophos's 2026 South African survey, most local organisations hit by ransomware said the attack was also their most significant identity attack of the year; these five controls are the answer.
Keeping systems healthy (8.6 to 8.9). Capacity management; protection against malware — the Information Regulator's first R5 million fine followed a ransomware attack where the protection licences had lapsed; management of technical vulnerabilities, with patching timescales you can defend; and configuration management, new in 2022, which asks for secure baselines that are documented, applied and watched for drift.
Data protection (8.10 to 8.12). Three new-in-2022 controls that read as a POPIA chapter: information deletion when data is no longer needed, data masking for test and analytics data, and data leakage prevention on the systems and channels that handle sensitive information.
Resilience (8.13 and 8.14). Information backup — with an offline or immutable copy and tested restores — and redundancy of processing facilities, read together with 5.29 and 5.30.
Logging, monitoring and time (8.15 to 8.17). Logging, protected and reviewed; monitoring activities, new in 2022, which turns "we keep logs" into "someone watches for anomalies and acts"; and clock synchronisation, so that logs across systems agree when an investigation needs them to.
Operational controls (8.18 to 8.19, 8.32 to 8.34). Use of privileged utility programs, installation of software on operational systems, change management — the operational counterpart of clause 6.3 and a near-twin of the change control any ISO 9001 system already runs — test information, and protection of systems during audit testing.
Networks (8.20 to 8.23). Network security, security of network services, segregation of networks — the control that matters most on a factory floor where PLCs and HMIs share a network with the office — and web filtering, new in 2022, which blocks the malicious sites that "paste this to fix your browser" lures depend on.
Cryptography (8.24). The rules for encryption and key management, which for personal information at rest and in transit are what POPIA section 19's "appropriate measures" increasingly means in practice.
Secure development (8.25 to 8.31). Secure development life cycle, application security requirements, secure architecture and engineering principles, secure coding (new in 2022), security testing, outsourced development and separation of environments. Many small and mid-sized organisations develop no software and mark several of these not applicable in the SoA with a justification — but in-house scripts, low-code apps, spreadsheets with macros and anything built for you by a contractor bring the controls straight back into scope, and the controls on buying applications securely (8.26, 8.29) usually stay in regardless.
From 114 to 93: what the 2022 restructuring did
The 2013 edition had 114 controls in 14 domains, numbered A.5 to A.18. The 2022 edition regrouped them into four themes, and the usual analyses describe the change as eleven controls new, around 57 merged into 24, about 23 renamed, and a handful dropped as standalone controls because their content was absorbed elsewhere. Nothing of substance was removed; what changed is the grouping and the vocabulary.
The domain-to-theme map is simpler than the numbers suggest. The 2013 policies domain became control 5.1; organisation of information security spread into 5.2 to 5.8 and remote working in 6.7; human resource security became the A.6 People theme; asset management became 5.9 to 5.13 with media and disposal moving to the physical theme; access control split into its policy half (5.15 to 5.18) and its technical half (8.2 to 8.5); cryptography became 8.24; physical and environmental security became the A.7 Physical theme; operations security scattered across 8.6 to 8.19 and 8.32; communications security became 5.14 and 8.20 to 8.22; system acquisition and development became 8.25 to 8.33; supplier relationships became 5.19 to 5.22; incident management became 5.24 to 5.28 and 6.8; business continuity became 5.29 and 8.14; and compliance became 5.31 to 5.36.
For an organisation certified under the 2013 edition this is history — the transition closed on 31 October 2025. For a new implementer it matters in one way: much of the free guidance online still uses 2013 numbers, and a template or checklist built on them will mislead you.
The attribute tags, and why they are worth using
ISO 27002:2022 gave every control five attribute tags, and each control page in the Clause Explorer shows them. Control type says whether a control is preventive, detective or corrective. Security property says which of confidentiality, integrity and availability it protects. Cybersecurity concept maps the control to the five functions a NIST-speaking customer will recognise — identify, protect, detect, respond, recover. Operational capability groups controls into fifteen practitioner domains such as asset management, identity and access management, supplier relationships security and continuity. Security domain places each in governance and ecosystem, protection, defence or resilience.
The tags are not required anywhere in the standard, but they answer questions auditors and customers actually ask. How many of your controls are detective rather than preventive? Which controls would you lean on in the respond and recover phases of an incident? Can you show a US customer your coverage of the NIST functions without writing a second framework document? A column of attribute tags in the Statement of Applicability answers all three.
Where to start
Not at A.5.1. Start with the asset inventory (5.9) and the risk assessment, because every other control decision depends on them. Then take the controls that decide whether an incident is survivable — privileged access and authentication (8.2, 8.5), malware and patching (8.7, 8.8), backup (8.13), logging and monitoring (8.15, 8.16), incident preparation (5.24) and awareness (6.3) — and make them real before the policy library grows. Then walk the rest of Annex A against the risk register for completeness, and let the Statement of Applicability record the result.
Free download: the 93 controls on one page
The ISO/IEC 27001:2022 Annex A Quick Reference is an A3 poster with all 93 controls in their four themes, the eleven new in 2022 flagged, the 114-to-93 restructuring in a line, and the attribute legend — built for the wall beside the SoA and for the first workshop with the process owners. Enter your email below and it is on its way. For the working document, the Gap Analysis Checklist scores every clause and every control with owners and dates, and every control's Clause Explorer page explains what the auditor will ask.
Qlause is an independent training and templates provider. It is not a certification body and this article is not a substitute for the standard. Sources: ISO/IEC 27001:2022 Annex A and ISO/IEC 27002:2022 (iso.org); A-LIGN — what is the difference between ISO 27001:2013 and 2022; Advisera — explanation of the eleven new controls; ANAB — changes in ISO/IEC 27001 and 27002 (attribute taxonomy); Sophos — State of Ransomware in South Africa 2026; Bowmans — the Information Regulator's first R5 million fine; Michalsons — Cybercrimes Act commencement.