Skip to main content
Policy Authority
Category: GRC Frameworks

Annex A

Also known as: Annex, Appendix A
Simply put

An annex is a supplementary document attached to a main document, such as a contract or standard, that adds further detail, specifications, or lists. "Annex A" typically refers to the first such attachment, and it commonly forms an integral part of the document it accompanies rather than standing alone. The label is generic, so the specific content of any "Annex A" depends entirely on the parent document in which it appears.

Formal definition

In general usage, an annex is a supplementary component that forms an integral part of a primary document, containing additional details, specifications, or enumerated items that are incorporated by reference into the main text. "Annex A" designates the first annex in an ordered sequence; its meaning and legal or normative weight are determined solely by the parent instrument (for example, a contract or a published standard) and cannot be inferred from the label alone. The evidence available here supports only this generic, document-structure sense; it does not establish the content of any specific "Annex A" within a particular GRC framework, standard, or regulation, and readers should consult the relevant source document to determine what a given Annex A contains and whether it is normative or informative.

Why it matters

The label "Annex A" carries no fixed meaning on its own. Because it is a generic document-structure convention, its significance for governance, risk, and compliance work derives entirely from the parent instrument in which it appears, whether that is a contract, a published standard, or a regulatory text. Treating "Annex A" as if it always refers to a particular set of provisions is a common error that can lead practitioners to cite the wrong content or to assume a normative weight that the annex may not carry.

In a GRC setting, the practical importance of an annex is that it commonly forms an integral part of the document it accompanies rather than standing alone. Where an annex is incorporated by reference into the main text, its contents may take on the same contractual or normative force as the body of the document. This matters for anyone assessing obligations, allocating responsibilities, or scoping controls, because overlooking an incorporated annex can mean overlooking binding detail. Conversely, some annexes are informative rather than normative, and misreading an informative annex as mandatory can produce unnecessary or misdirected effort.

Because the specific content and status of any given "Annex A" depends on its source, the safest practice is to identify the parent document precisely and consult it directly rather than relying on the label alone. The evidence available here supports only the generic sense of the term and does not establish what any particular Annex A contains within a specific framework, standard, or regulation.

Who it's relevant to

Compliance officers and legal specialists
When interpreting contracts or regulatory instruments, these professionals need to determine whether an annex is incorporated by reference into the main document and whether its provisions are normative or merely informative. The label "Annex A" alone does not answer these questions; the parent document must be consulted to establish content and status.
Governance professionals and risk managers
Those scoping obligations, allocating responsibilities, or defining controls may rely on annexed material that forms an integral part of a governing document. Identifying the correct parent instrument and reading its annexes directly helps avoid overlooking binding detail or misclassifying supplementary content.
Internal auditors
In evaluating whether documented requirements have been met, auditors should trace any "Annex A" back to its source document to confirm what it actually contains and whether it carries normative weight, rather than assuming a fixed meaning from the generic label.

Inside Annex A

Reference control set
Annex A, in the context of ISO/IEC 27001, provides a catalogue of information security controls that organizations may consider when treating information security risks. It functions as a reference list rather than a mandatory checklist to be implemented in full.
Control themes or categories
The controls in Annex A are commonly organized into thematic groupings (such as organizational, people, physical, and technological categories in more recent revisions), providing structure for selection and review. The specific grouping and numbering vary by version of the standard.
Link to the Statement of Applicability (SoA)
Annex A is typically used alongside the Statement of Applicability, in which an organization records which controls it has selected, justifies inclusions and exclusions, and describes implementation status. The SoA, not Annex A itself, documents the organization's specific decisions.
Risk-driven basis for selection
Controls are intended to be selected on the basis of the outcomes of a risk assessment and risk treatment process. Annex A supports risk treatment by offering candidate controls but does not itself perform risk assessment.

Common questions

Answers to the questions practitioners most commonly ask about Annex A.

Is Annex A a mandatory checklist of controls that every organization must implement?
No. Annex A is commonly understood as a reference set of controls rather than a mandatory checklist. In the ISO/IEC 27001 approach, the controls an organization implements are typically driven by its risk assessment and risk treatment decisions. Annex A serves as a catalogue to be compared against, so that necessary controls are not inadvertently omitted, but organizations may exclude controls that are not applicable to their context, provided the exclusion is justified and documented. The specific selection depends on the organization's scope, risk profile, and objectives.
Does implementing all of the Annex A controls mean an organization is fully secure or automatically certified?
No. Applying controls from Annex A does not guarantee security outcomes, nor does it by itself confer certification. Annex A supports the treatment of identified risks, but effectiveness depends on how controls are designed, operated, and maintained over time. Certification, where sought, typically involves an accredited body assessing the management system as a whole against the standard's requirements, not merely confirming that a list of controls has been adopted. Residual risk commonly remains even where controls are in place.
How is Annex A typically used during risk treatment?
Annex A is commonly used as a comparison reference after risks have been identified and assessed. Once an organization decides how to treat a given risk, it may consult Annex A to check whether relevant controls have been considered. Any controls determined to be not applicable are generally recorded, along with the reasoning, in a document commonly known as the Statement of Applicability. This entry does not address specific implementation steps or tooling.
What is the relationship between Annex A and the Statement of Applicability?
The Statement of Applicability commonly documents which Annex A controls are applicable, whether they are implemented, and the justification for including or excluding each. It functions as a traceable link between the organization's risk treatment decisions and the reference controls. Practitioners often maintain it as a living document, updating it as scope, risks, or controls change. The precise format and content expectations may vary by certification body and organizational context.
Who within an organization is typically responsible for selecting and maintaining Annex A controls?
Control selection and ongoing maintenance are commonly management responsibilities, often coordinated by an information security function alongside relevant risk and business owners. Consistent with the three lines model of the IIA, the operation of controls generally sits with management functions, while independent assurance over their effectiveness is typically provided separately by internal audit. Keeping these responsibilities distinct helps preserve the objectivity of assurance activities.
How often should the applicability of Annex A controls be reviewed?
Review frequency commonly depends on the organization's risk environment, the pace of change in its scope or threats, and any internal or external requirements it has adopted. Many organizations review control applicability periodically and also in response to significant changes, such as new systems, regulatory developments, or incidents. This entry does not prescribe a specific interval, as appropriate timing varies by context; organizations typically define their own review cadence within their management system.

Common misconceptions

All Annex A controls must be implemented to achieve certification.
Annex A is commonly treated as a reference set from which controls are selected based on risk treatment decisions. Organizations typically document justified inclusions and exclusions in the Statement of Applicability rather than adopting every control.
Annex A is a complete or exhaustive list of every possible security control.
Annex A offers a reference catalogue, and organizations may need to add controls not listed there to address their specific risks. It is a starting point for selection, not an upper limit.
Implementing Annex A controls is itself the management system.
Annex A supports the risk treatment element of an information security management system, but the broader management system encompasses governance, risk assessment, objectives, monitoring, and continual improvement. The controls address identified risks; they do not replace those surrounding processes.

Best practices

Drive control selection from the outcomes of a documented risk assessment and risk treatment process rather than adopting Annex A controls by default.
Maintain a Statement of Applicability that records each control's inclusion or exclusion with clear justification and implementation status.
Confirm which version of the standard applies, since the organization, numbering, and grouping of Annex A controls vary across revisions.
Consider whether additional controls beyond Annex A are needed to address risks specific to your jurisdiction, sector, or organization.
Review and update control selections and the Statement of Applicability as risks, objectives, and the operating environment change.
Keep assurance and audit activities distinct from the implementation of controls, so that the effectiveness of selected controls can be evaluated independently.
Application Security Isn’t Optional Anymore.