It is not certifiable: it has no requirements, only guidance, attributes and examples for the 93 controls that Annex A lists by title. Organizations working towards ISO 27001 use it to decide what each selected control should look like in their environment and to write the control descriptions in the Statement of Applicability.
The 2022 edition reorganised the controls into four themes and added attributes such as control type and cybersecurity concept. The ISO 27001 and ISO 27002 comparison covers the differences.
Read more
Related terms
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.
- Annex A
- Annex A of ISO/IEC 27001:2022 is the reference list of 93 information security controls, grouped into organizational, people, physical and technological themes.
- Statement of Applicability
- The Statement of Applicability is the mandatory ISO 27001 document listing which Annex A controls apply, which are excluded and why.