Practitioner · roles
Annex A Controls Explained
A practical walk through all four Annex A themes: organizational, people, physical and technological. Learn how controls are selected through risk treatment, how to justify inclusions and exclusions in the Statement of Applicability, and what ‘good’ looks like for a 20 to 200 person Indian business. Completing this course does not certify your organisation or make it compliant; certification comes only from an accredited certification body’s audit.
5 modules~115 minutesFinal exam: 20 questions · 40 min · pass 75%Valid 24 months
Who it’s for
Managers, IT leads and control owners in small and mid-size businesses who need to understand the 93 controls of ISO/IEC 27001:2022 Annex A and how to apply them proportionately.
After this course, people can
- Explain how Annex A relates to risk treatment and the Statement of Applicability under clause 6.1.3.
- Navigate the four themes and 93 controls using their numbers and short titles, grouped in practical clusters.
- Write clear, risk-based justifications for including or excluding a control.
- Describe what a proportionate implementation of key controls looks like in a small or mid-size business.
- Identify realistic evidence an auditor may ask for when testing a control.
Modules
- How Annex A Works14 min
- Organizational Controls (5.1–5.37)18 min
- People Controls (6.1–6.8)13 min
- Physical Controls (7.1–7.14)13 min
- Technological Controls (8.1–8.34)18 min
- Final exam · 20 questions · pass 75%After all modules