Many organisations use the controls listed in Annex A as a menu or checklist of best practice controls to be implemented in order to provide a level of information security.
However, URM recommends that your risk assessment is used to determine which controls are relevant, as some of them may not be applicable to your organisation.
We would also recommend that you don’t use Annex A in isolation as ISO 27002 provides very good additional guidance on how controls should be implemented.
It should also be noted that following your risk assessment, you may identify risks that cannon be adequately mitigated using the supplied controls. The standard provides the flexibility to permit the creation or introduction of additional controls from other sources which you may wish to implement to address unique risks.
Without doubt, URM helped us to achieve our planned objectives a lot sooner than expected. The engagement was a huge success and couldn’t have gone any better.
Postal service company
Thinking about ISO 27001 but unsure how your project should take shape?
We offer a free, no‑commitment call to help you clarify your certification pathway, understand the standard in the context of your business.
Find out more
related BLog
ISO 27001 Clause 7.5: Documented Information Explained
Published on
27 Apr
2026
URM’s blog breaks down ISO 27001 Clause 7.5 requirements, with practical guidance on how to achieve conformance to this Clause & what external assessors expect.
Read more
Information Security
Published on
15/4/2026
ISO 27001 – Clause 6.3: The Importance of Planned ISMS Change ManagementURM’s blog explains the purpose & requirements of ISO 27001 Clause 6.3, types of ISMS change it covers, and key considerations when putting it into practice.
Read more
Information Security
Published on
2/4/2026
Transitioning to ISO 27001:2022If your organisation is looking to transition to ISO 27001:2022, URM’s blog provides practical and invaluable guidance on meeting the new requirements.
Read more
Information Security
Published on
2/4/2026
What is the CIA Security Triad? Confidentiality, Integrity and Availability ExplainedURM’s blog explains how the principles of confidentiality, integrity and availability (CIA) can help align your information security controls with best practice
Read more
"
I am pleased to recognise the work of the URM internal auditor we have worked. Throughout all the audits carried out, he has consistently demonstrated professionalism, diligence, and a commitment to excellence in every task undertaken. Thanks to his efforts, we have achieved a very successful first stage ISO 27001:2022 certification audit, with zero findings noted, which has positioned us on track for the second stage audit and for long-term success.
contact US
Let us help you
Let us help you in your compliance journey by completing the form and letting us know how we can best support you.