It links control decisions to the risk assessment and is one of the first documents a certification auditor reads. It should be produced from the risk treatment decisions, not maintained as a separate spreadsheet that drifts.
See Annex A.
Read more
Related terms
- Annex A
- Annex A of ISO/IEC 27001:2022 is the reference list of 93 information security controls, grouped into organizational, people, physical and technological themes.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.
- Information security management system
- An information security management system is the set of policies, processes and responsibilities an organization uses to manage information security risk.