ISO/IEC 27001 requirements and Annex A controls in an audit context
The clause thread an auditor follows
Clause 4: issues, interested parties, scope, processes. Clause 5: leadership, policy, roles. Clause 6: risk assessment (repeatable, producing consistent, comparable results), risk treatment, Statement of Applicability, objectives. Clause 7: resources, competence, awareness, communication. Clause 8: operational planning plus risk assessments executed at planned intervals or on significant change. Clause 9: monitoring and measurement, internal audit programme, management review inputs and outputs. Clause 10: continual improvement, and nonconformity and corrective action.
Annex A (2022)
93 controls in four themes: organisational (A.5), people (A.6), physical (A.7), technological (A.8). The numbering changed from the 2013 edition - there is no 'A.9 Access control'. New or reworked subject areas include threat intelligence (A.5.7), data masking (A.8.11) and physical security monitoring (A.7.4). Audit the controls the client has selected and justified in the SoA; effectiveness, not documentary existence, is the test.
Typical evidence questions
- 5.2: can staff state the policy relevant to their role?
- 6.1.2: are assessments repeated consistently and comparable over time?
- 8.1: is the risk treatment plan actually being delivered?
- A.5.15: is access granted, reviewed and revoked against records?
- A.8.16: are monitoring results reviewed and acted on?
Traps
- Auditing Annex A in isolation from clause 6.1 - the SoA is the bridge.
- Confusing 'documented' with 'effective' - clause 7.5 only requires documented information where the standard or the organisation demands it.
- Missing the 2022 renumbering, or quoting withdrawn 2013 clause numbers.
- Overlooking that 10.1 is continual improvement and 10.2 is nonconformity and corrective action in the 2022 edition (swapped from 2013).
Rule of thumb
For each SoA entry, ask: does the justification match the risk, is the control operating, and is there evidence that someone checks it works?