Annex A Control Catalogue

The Annex A control catalogue holds the 93 controls of ISO 27001:2022 Annex A. It is the vocabulary a risk's treatment is chosen from, and the list the Statement of Applicability accounts for line by line.

This is the one catalogue in QDMS Now that is not really yours. Its rows come from a published standard, they are numbered by that standard, and an auditor will expect to find all 93 of them.

Fields

• Code
  The standard's own reference — A.5.1 through A.8.34. Typed in, not generated. See below.

• Name
  The control's title.

• Control theme
  Which of Annex A's four themes it belongs to.

• Description
  What the control requires.

• Standard control
  Whether this row comes from the standard. Read-only, and see below.

• Active
  Inactive controls are no longer offered when selecting a treatment.

The four themes

The 2022 revision groups its 93 controls into four themes:

Theme	Annex A clause	Covers	Controls
Organizational	A.5	Policies, roles, supplier and incident management	37
People	A.6	Screening, terms of employment, awareness, discipline	8
Physical	A.7	Perimeters, entry, equipment, media, clear desk	14
Technological	A.8	Endpoints, access, cryptography, logging, development	34

This catalogue is numbered by the standard, not by QDMS Now

Unlike every other definition list in the module, the code field here has no generate button. The code is the standard's own reference and it is typed in.

The reason is simple: A.8.8 is not an identifier QDMS Now is entitled to invent, and an auditor reading your statement will match its codes against the standard's.

A standard control is frozen

The 93 seeded rows are marked as standard controls, and that carries two hard rules:

• A standard control cannot be deleted. The Statement of Applicability has to account for all 93, which a missing row cannot do.
• Its code cannot be changed. An audit trail that renumbers A.5.1 is worthless.

note

Nothing a client sends can move a row across the line between the standard's own rows and your additions. The standard control flag is not something the screen submits — it is shown as plain text and never sent. So a row that came from the standard stays one, and a row you added stays yours.

What you can still do

• Deactivate a standard control. It leaves the treatment picker; the statement still accounts for it.
• Rewrite its description, to say what the control means in your organization.
• Add controls of your own. Your additions are ordinary rows: renumberable, deletable, yours.

tip

Rewriting the descriptions is the highest-value thing you can do with this catalogue. The standard's own wording is deliberately abstract; a description that says what A.8.16 Monitoring activities means on your systems is what makes the treatment picker usable by somebody who is not an ISO 27001 specialist.

Existing controls and selected controls

A risk record references this catalogue twice, and the two mean different things:

On the risk	Means	Feeds the statement's suggestion
Existing controls	Already in place, factored into the initial score	No
Selected controls	Chosen as this risk's treatment, with a justification	Yes

Only selected controls imply applicability. A control already in place is not evidence that the standard's clause applies to this scope — it may be there for an unrelated reason.

See Information Security Risk.

Measures name a control too

A risk measure records which Annex A control it implements. That is what connects the work back to the standard, and what the statement's implementation status is read against.

Deleting a control

Three refusals apply:

• A standard control cannot be deleted at all.
• Any control named by an open risk cannot be deleted.
• Any control that a Statement of Applicability answers for cannot be deleted.

The third is the one that surprises people, and it exists because statement lines are generated. Nobody would think of a statement as something to clear first, so the refusal has to be explicit.

Bulk delete refuses the whole selection if any row is blocked.

The catalogue is seeded once

All 93 rows ship on first install only, gated on a version record. A later upgrade never re-adds a row you removed or overwrites a description you rewrote — those are decisions about your own catalogue.

The rows ship in English, using ISO's own control titles rather than a translation of them, so that the codes and titles match what an auditor is reading from.

Excel import and export

The catalogue exports to Excel and re-loads from a filled-in template. Because standard controls are frozen, an import can update the descriptions of the shipped rows and add rows of your own, but cannot renumber or remove the standard's 93.