The latest articles on DEV Community by AnkitS (@itsupport247). https://dev.to/itsupport247 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4196590%2F95cfff41-c941-4682-ad84-d0e133973740.png https://dev.to/itsupport247 en AnkitS Tue, 20 Oct 2026 16:58:26 +0000 https://dev.to/itsupport247/iso-27001-annex-a-controls-how-to-choose-and-record-them-3edb https://dev.to/itsupport247/iso-27001-annex-a-controls-how-to-choose-and-record-them-3edb <p>Annex A of ISO 27001 lists 93 controls, which makes many people assume they must implement all of them. They do not.</p> <h2> A technical primer </h2> <ul> <li>Annex A groups controls into organisational, people, physical and technological themes.</li> <li>Your risk assessment decides which controls you need.</li> <li>Annex A is then used to check you have not missed any.</li> <li>The Statement of Applicability records what you chose, its status and the reason for any exclusion.</li> </ul> <p>Auditors will ask for evidence that each selected control actually operates.</p> <h2> Why this matters </h2> <p>If your risk assessment flags lost laptops, you might select controls for device encryption, remote wipe and an asset inventory. Each one is recorded, given an owner and backed by evidence.</p> <h2> A practical next step </h2> <p>If a control does not apply, such as secure development for a business that writes no software, record that and the reason. A clear reason is accepted by auditors. A blank is not.</p> <h2> Where to go next </h2> <p>If you want more detail, read <a href="https://itsupport247.technology/blog/iso-27001-controls-annex-a/" rel="noopener noreferrer">Annex A explained with examples</a> on the IT Support 247 blog. If you would like help applying it to your own organisation, see <a href="https://itsupport247.technology/services/iso-27001/" rel="noopener noreferrer">ISO 27001 guidance for Australian businesses</a>.</p> <p><em>IT Support 247 is a Melbourne IT support and compliance provider working with organisations across Australia.</em></p> security