Connect the 2022 Annex A reference set to the organization's actual ISMS evidence: why each necessary control was selected, whether it is implemented, what shows it operates, and how results are evaluated.
This guide helps connect risk treatment, the Statement of Applicability, ISO/IEC 27002 control guidance, internal audit results, management review, and corrective action.
Structured answer sets in this page tree.
Cited legal and guidance references.
ISO/IEC 27001:2022 contains 93 controls: 37 organizational, 8 people, 14 physical, and 34 technological. They are a reference set for the Clause 6.1.3 completeness comparison, not a requirement to implement all 93. This page shows a practical evidence structure for controls the organization determines are necessary.
ISO/IEC 27001:2022 does not ask teams to paste into a spreadsheet and call it done. The control evidence trail starts with the ISMS scope, information security risk assessment, and risk treatment decisions. Annex A is then used as a reference set to verify that necessary controls have not been missed.
For every necessary control, the Statement of Applicability must explain why it is included and whether it is implemented. It must also justify every excluded control. An evidence location is not one of the four required SoA contents, but adding one helps reviewers test the decision against current records.
ISO/IEC 27001 does not require a separate evidence pack for every control. Where a pack or index helps, separate design evidence from operating evidence. Design evidence shows how the control is defined; operating evidence shows the process ran during the relevant period.
The evidence pack should be easy to sample. For access control, that may mean access rules, joiner-mover-leaver tickets, privileged access approvals, and periodic access reviews. For incident-related controls, it may mean event handling records, evidence preservation procedures, lessons learned, and corrective actions. For technological controls, it may mean configuration exports, monitoring alerts, vulnerability records, backup results, or audit-test safeguards.
This guide helps map selected controls to SoA rationale, owners, operating evidence, effectiveness checks, audit findings, and improvement actions.
Convert Annex A control decisions into assigned evidence requests, review checkpoints, and audit-ready records.
Review your current SoA, control evidence gaps, ownership model, and audit-readiness priorities.
Assign an accountable owner who can explain how each necessary control operates, which records support it, and what happens when it fails. Tie ownership to the team that runs the control, such as identity, infrastructure, engineering, HR, facilities, procurement, legal, risk, security operations, or the relevant service owner.
Effectiveness checks should test whether the control achieves its intended result, not merely whether a document exists. Clause 9.1 requires the organization to decide what to monitor and measure, the methods, timing, responsibilities, and analysis, and to retain evidence of results. It does not require the same test or frequency for every control.
Internal audit should be able to test the control trail without reconstructing it from memory. The audit file should show the audit scope and criteria, the selected controls, the samples tested, results, nonconformities or observations, and reporting to relevant management.
Certification readiness improves when the team can show a current SoA, risk treatment linkage, controlled documented information, operational samples, results of monitoring and measurement, internal audit records, management review outputs, and corrective actions. The goal is not a larger folder; it is a clearer evidence path.
evidence becomes stale when systems, suppliers, responsibilities, threats, or business processes change. Clause 8.1 requires planned changes to be controlled and the consequences of unintended changes to be reviewed. Clause 8.2 separately requires risk assessment at planned intervals and when significant changes are proposed or occur.
Evidence gaps and repeated control failures can feed monitoring, internal audit, corrective action, risk treatment, and management review. Clause 9.3 prescribes management-review inputs and requires decisions about continual improvement opportunities and needed ISMS changes; it does not prescribe a particular evidence-quality agenda.
"Information security management systems — Requirements"
"Information security controls"
"Guidance on managing information security risks"