Can I use Annex A as an information security controls checklist?

Many organisations use the controls listed in Annex A as a menu or checklist of best practice controls to be implemented in order to provide a level of information security.  

However, URM recommends that your risk assessment is used to determine which controls are relevant, as some of them may not be applicable to your organisation.  

We would also recommend that you don’t use Annex A in isolation as ISO 27002 provides very good additional guidance on how controls should be implemented.  

It should also be noted that following your risk assessment, you may identify risks that cannon be adequately mitigated using the supplied controls.  The standard provides the flexibility to permit the creation or introduction of additional controls from other sources which you may wish to implement to address unique risks.