This correlation lists each ISO 27001:2022 Annex A control with where it is covered in the IMS1 manual, ready to carry into your Statement of Applicability.

Effective Guidance Documents

These reference documents are supplied in PDF format within the alphaZ toolkits. They are for reference and are not intended to be edited.

alphaZ documents - tried and tested guidance documents. No junk, jargon or unnecessary content, developed over 25 years through practical use in the real world.

Further Reading

Further guidance on ISO 27001 Annex A:

• ISO 27001 Annex A Controls
• ISO 27001 Clause 6.1.3 - Information Security Risk Treatment
• Managing Information Security Risks
• ISO 27001 knowledge base

How to Download

These documents are supplied only within the alphaZ toolkits and are not sold on their own. They are included in the ISO 27001 toolkit and the integrated toolkits that include it.

Need Help Implementing?

If you'd like hands-on help completing your Statement of Applicability and information security risk treatment, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

ISO 27001:2022 Annex A Correlation and Guidance

The ISO 27001:2022 Annex A Correlation and Guidance brings together a correlation of the Annex A controls and an overview and guidance document for ISO 27001. The correlation lists every Annex A control from ISO 27001:2022 with an evidence note outlining or referencing where the control is covered in the IMS1 manual.

The controls follow the same listing as the F-IMS26 Statement of Applicability, and the evidence notes can be amended and carried into the Statement of Applicability for each control that applies.

Two Reference Documents

• ISO 27001:2022 Annex A Correlation - each Annex A control with an evidence note referencing the IMS1 manual
• ISO 27001 Overview and Guidance - an introduction to the standard and its main requirements, with the points to have in place before a certification audit

What the Correlation Covers

• Organisational Controls - policies, roles, asset inventory, classification, access, suppliers, cloud, incidents and continuity
• People Controls - screening, employment terms, awareness and training, confidentiality and remote working
• Physical Controls - perimeters and entry, securing offices, clear desk, equipment, storage media and utilities
• Technological Controls - endpoint devices, access, malware, backup, logging, networks, cryptography and development

Who Needs an ISO 27001:2022 Annex A Correlation?

The correlation is for organisations using the alphaZ IMS1 manual and documents with an ISO 27001:2022 information security management system, when completing the Statement of Applicability and preparing for internal and certification audits.

Included in the ISO 27001 Toolkit

These documents are part of the ISO 27001 toolkit and the integrated toolkits that include it.

Using the Correlation

For each control that applies, carry the evidence note into the editable F-IMS26 Statement of Applicability; for each control that does not, record the justification. The clause by clause audit checklist for the main body of the standard is in the ISO 27001:2022 Requirements Checklists.

Note: ISO clause checklists only include the clause numbers and short prompts for each clause (due to copyright reasons) and therefore a full version of the ISO standard is required to be used in conjunction with these checklists.

Related Documents

The ISO 27001:2022 Correlation covers clauses 4 to 10 of the standard. The controls are applied through documents such as the ER15 Information Security Risks Register, the F-Q14 Information Assets Matrix and PP-8-100 Information Security Policy Procedure.