The standard does not start at Annex A

Ask an organisation about the state of its ISO 27001 and you often get a table with 93 rows: the controls from Annex A, each with a status. The table matters. But it is not the standard.

The requirements you are certified against are in clauses 4 to 10. Annex A is a reference list of controls. In its section on risk treatment, the standard requires you to compare the controls you have chosen with this list so that none of the necessary ones is missing, and to record the result in the statement of applicability, with a justification for every inclusion and exclusion. Annex A is therefore the tool of a requirement in clause 6, not a substitute for it.

What clauses 4 to 10 contain

In substance, since the text of the standard is not freely available: clause 4 requires understanding the context of the organisation and the interested parties with their requirements, and determining the scope, including its boundaries and interfaces. Clause 5 sets out the responsibility of top management, the information security policy and the roles. Clause 6 contains risk assessment, risk treatment, the statement of applicability and measurable objectives. Clause 7 covers resources, competence, awareness, communication and documented information, clause 8 operation. Clause 9 requires monitoring and measurement, an internal audit programme and the management review, clause 10 corrective action and continual improvement.

These clauses cannot be ticked. They require decisions that someone takes and documents, and processes that repeat: an audit that actually took place, a management review that actually reviewed. Whoever maintains only Annex A has a good list of controls, but no management system carrying it.

Implemented does not mean evidenced

The second gap is subtler. A clause is marked "implemented" because at some point there was a policy, an audit, a management review. Whether the policy is still valid, whether the audit was within the last year, whether the review was approved, the status does not say. It says what someone once entered.

How isidaten handles it

In isidaten, clauses 4 to 10 are a catalogue of their own with 30 assessable clauses, separate from Annex A, each with status, responsible person, deadline and justification. It deliberately does not contain the text of the standard, only number and heading. A cockpit guides through the build-up in eleven steps, from scope via context, policy, risks, statement of applicability and risk treatment plan to preparing for certification.

Evidence checks compare the entered status with the underlying records. Was the statement of applicability approved within the last twelve months? Is the internal audit within twelve months? Is the management review approved and current? Is there an approved, valid policy? If a clause is marked implemented but one of these checks finds no evidence, or only outdated evidence, the clause shows the notice "evidence missing". Certification readiness accordingly counts only the clauses requiring documentation that are implemented and for which no check reports a gap, shown as "x of 14 evidenced".

For clause 4 there are registers for context issues, interested parties and objectives, with parties optionally linked to the legal register. The management review shows which context issues and parties have changed since the last review, because that is exactly what it asks about. And the risk treatment plan is built from the risk analyses, with measures, deadlines, budget, residual risk and acceptance per risk.

One limitation belongs here: the checks show whether evidence exists and is current. Whether it holds up in substance is still for the audit to decide.

The test question

When was your last management review, and which changes regarding interested parties did it cover?

If the answer begins with "well, we have Annex A", the management system is still a list of controls.

Sources

ISO/IEC 27001:2022, German edition DIN EN ISO/IEC 27001:2024, clauses 4 to 10 and Annex A, in particular clause 6.1.3 (paraphrased; the text of the standard is protected by copyright and not freely available).