Integrated management systems · Basic · 12 min lesson
Planning and support - risk, Statement of Applicability, Annex A and documented information
ISO/IEC 27001:2022 with Amendment 1:2024 - clauses 6 and 7, Annex A structure
What you will learn
- Describe the information security risk assessment and treatment process of clauses 6.1.2 and 6.1.3, and what the Statement of Applicability must contain.
- State the requirements for objectives, resources, competence, awareness and documented information in clauses 6.2, 6.3 and 7.
- Describe the structure of Annex A 2022 (93 controls in 4 themes) and spot unjustified exclusions in a Statement of Applicability.
Key takeaways
- Clause 6.1.2 and 6.1.3: assess risks with defined criteria and owners, choose treatments, then compare controls with Annex A.
- The Statement of Applicability lists necessary controls, justifies inclusions and exclusions and shows implementation status.
- Risk owners approve the treatment plan and accept residual risk; objectives are measurable where practicable (6.2).
- Clause 7 requires resources, evidenced competence, awareness, communication and controlled documented information.
- Annex A 2022 has 93 controls in 4 themes: organizational 37, people 8, physical 14, technological 34.
Free practice question
Marden Health Apps, a fictional mobile-app vendor, bought a list of the 93 Annex A controls and implemented all of them in order, without a risk assessment. The auditor asks how the controls were chosen.
What is the best assessment?
The approach inverts clause 6.1.3: controls must be determined from risk treatment and then compared with Annex A.
Correct. Clause 6.1.3 b) determines necessary controls from the risk treatment options, and c) compares them with Annex A as a completeness check.
It is the intended method, since Annex A is the source of all requirements.
Not quite. Annex A is a reference for comparison; clause 6.1.3 makes risk treatment the basis for selection.
It is fine, because a risk assessment is optional when all controls are applied.
Not quite. Clause 6.1.2 requires a risk assessment process regardless of how many controls end up applied.
It fails only because 93 controls is too many for a small company.
Not quite. No clause limits the number of controls; the issue is the absence of risk-based selection under clause 6.1.3.
Key terms
- Statement of Applicability: Document listing necessary controls, why they are included, whether implemented, and why Annex A controls are excluded.
- risk owner: Person with accountability and authority to manage a risk and accept its residual level.
- residual risk: The risk that remains after treatment controls are applied.
- Annex A: Reference list of 93 information security controls in four themes in the 2022 edition.
- documented information: Information the organisation controls and maintains, covering what used to be called documents and records.
- ISO/IEC 27002: Guidance standard that explains each Annex A control in detail, with purpose and attributes.
Official sources
- ISO/IEC 27001:2022 - Information security management systems
- ISO/IEC 27002:2022 - Information security controls
- ISO/IEC 27002:2022 guide: controls and changes (SureCloud)
- ISO 27001:2022 and ISO 27002:2022 explained (Secureframe)
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.