ISO 27001 Controls Management: Track Annex A Status
By GRCompliance team
Controls management is the ongoing work of deciding which security controls you need, implementing them, and checking that they keep working. It also means being able to show, for each control, who owns it, how far along it is and what proves it. In ISO/IEC 27001:2022, controls come out of risk treatment. Clause 6.1.3 b) asks you to determine all the controls needed to treat your risks, and 6.1.3 c) asks you to compare them with Annex A so that nothing necessary is missed. Annex A lists 93 controls in four themes: organisational (A.5, 37 controls), people (A.6, 8), physical (A.7, 14) and technological (A.8, 34). Clause 9.1 then requires you to decide what to monitor and measure, including the controls themselves, and how and when to do it.
NIS2 does not use Annex A, but its Article 21(2) sets out the minimum measures in ten points, (a) to (j). They run from risk analysis and incident handling to business continuity, supply chain security, cryptography, access control and multi-factor authentication. Article 21(2)(f) adds "policies and procedures to assess the effectiveness" of those measures. Article 21(4) requires corrective measures without undue delay when you find you do not comply. Most of these map naturally onto Annex A controls, which is why many organisations run one controls library for both.
Why controls management matters for security
A control that exists only on paper does not protect anything. The gap between "we have a backup policy" and "backups are taken, tested and restorable" is where real incidents happen. Controls management is how you find that gap before an attacker or an outage does.
What goes wrong without it:
- Status by assumption. Everyone believes access reviews happen quarterly because the policy says so. Nobody has checked since the person who ran them left.
- Orphaned controls. A control with no accountable owner degrades quietly, because nobody notices when it stops working.
- Duplicate effort across frameworks. If ISO 27001, NIS2 and customer questionnaires are tracked separately, the same control is assessed three times, and three slightly different answers are given.
- No line of sight to risk. If you cannot say which risks a control reduces, you cannot prioritise it, fund it or defend removing it.
An ISO 27001 auditor tests controls by sampling. They pick a control from your Statement of Applicability, ask how it is implemented and who is responsible, and then ask for evidence that it operated during the period. They also check that your monitoring is real, as clause 9.1 requires. NIS2 supervisors look for the same thing from a legal angle. Article 20(1) makes management bodies responsible for approving and overseeing the measures. For the digital providers it covers, Implementing Regulation (EU) 2024/2690 requires regular compliance monitoring reported to the management body (Annex point 2.2) and independent reviews (point 2.3).
Good practice and common mistakes
Adopt controls from risk, not from a list. Start from your risk treatment decisions, then use Annex A as the completeness check that 6.1.3 c) describes. Annex A is not exhaustive. If a risk needs a control that is not in it, add your own.
Give every control one accountable owner. RACI works well here: one person accountable, others responsible for the work, consulted or informed. Accountability should sit with someone who can fix the control when it fails.
Use honest, simple statuses. Not implemented, in progress, implemented. A control is not implemented until it operates and you can show evidence of it. "Implemented" with no evidence is the single most common finding I would expect an auditor to raise.
Set a monitoring frequency per control. Technical controls that change often (privileged access, vulnerability management, backups) deserve more frequent checks than stable ones. Clause 9.1 asks you to decide this explicitly.
Map once, reuse often. Map each control to every framework it supports, so one implementation and one set of evidence serve ISO 27001, NIS2 and any customer requirements at once.
Common mistakes:
- Treating the 93 Annex A controls as 93 projects, rather than a checklist against your risk treatment.
- Ownership assigned to teams or mailboxes, not people.
- Implementation notes that say "done" and nothing about how, where or by whom.
- Monitoring frequency set once and never followed.
- No link between controls, risks and policies, so changes in one never trigger a review of the others.
ISO/IEC 27002:2022 gives guidance on implementing each Annex A control. It is worth having to hand when you write the implementation notes.
How to do it in GRCompliance
GRCompliance is a free, self-hosted GRC platform. The screenshots below come from the Latore LTD workspace, a fictional demo company with sample data.
Start with the Global Control Library, the master list of controls for every framework in the platform. Search by keyword, or filter by framework, for example NIS2, to see what exists before you adopt anything into your workspace.
The controls your organisation has adopted appear under Governance → Controls, grouped by ISO 27001 theme, and can come from ISO 27001, SOC 2 and NIS2. Switch to the table view for the status picture. It shows monitoring frequency, justification and implementation status for each control. A red marker flags controls with no evidence yet, which are the ones to look at first. If you are working on one standard at a time, the framework filter narrows the table to, say, ISO 27001 only.
Click a control to open its details. In the demo this is CC-004 Cloud services, with tabs for Implementation, Evidence, Related Controls and Discussion. This is where most of the work happens. Change the status as the work progresses, for example from Not Implemented to In Progress, and set how often the control is monitored, for example quarterly.
Under RACI Assignments, choose who is responsible, accountable, consulted and informed. Pick one accountable person: that is the name that comes up when the control is sampled in an audit. Then add a short implementation note and save. Write the note for someone joining the team next year: what was done, where, and how you know it works. The control now shows as In Progress, and stays flagged until evidence is linked. That flag stops the status getting ahead of reality.
Controls rarely stand alone. In a policy's Links tab you can link the controls that enforce the policy and the risks it mitigates, and the relationship map shows them together. When a risk changes or a policy is revised, you can see straight away which controls are affected. The policy management guide and the risk register guide cover those two sides.
Finally, keep an eye on evidence. The Evidence Collection page shows the total number of controls, how many are verified, how many are missing documents, and the completion rate, which gives you one number to report each month. The evidence collection guide shows how to raise it, and the Statement of Applicability guide shows how these controls feed your SoA.
FAQ
How many controls are in ISO 27001:2022 Annex A?
93, in four themes: organisational (37), people (8), physical (14) and technological (34). You only implement the ones your risk treatment and Statement of Applicability make applicable, but every one needs a decision.
Are NIS2 measures the same as ISO 27001 controls?
Not exactly. NIS2 Article 21(2) lists ten minimum areas of measures, (a) to (j), rather than individual controls. Most of them map onto Annex A controls, so one controls library mapped to both frameworks avoids duplicated work.
What does the red marker in the GRCompliance controls table mean?
It flags a control that has no evidence linked yet. It stays until evidence is added and linked to the control.
Who should own a control?
One accountable person who can fix the control when it fails, supported by the people responsible for operating it. GRCompliance records this as RACI assignments on each control.
Watch the video
The video follows the same path in GRCompliance: the control library, workspace controls, status and monitoring, RACI and evidence progress.
Try it yourself
Pick one control you believe is implemented, such as backups or access reviews, and record it properly: owner, status, monitoring frequency and evidence. It is the quickest way to find out how much of your status is assumption.
- Explore the live demo: the fictional Latore LTD workspace used in the screenshots above.
- Download the free Community edition: free, open source, and self-hosted on your own infrastructure. The self-host quickstart gets you running.
- Visit grcompliance.com to see the platform and services, including Compliance-as-a-Service.