Mapping ISO 27001 Annex A controls to the IT controls you already run stops you from rebuilding security work that's already in place — and shows an auditor exactly where your existing firewall rules, access policies and backup routines satisfy the standard.
Why this matters
Most growing businesses already run half of Annex A before they ever open the standard. Firewalls, MFA, patch cycles, offboarding checklists — these exist because good IT teams build them anyway, not because someone asked for ISO 27001.
The mistake is treating certification as a fresh build. Auditors in 2026 want evidence that existing controls satisfy each Annex A requirement, plus a documented reason for any control you've excluded. Skip the mapping step and you'll duplicate work, confuse your Statement of Applicability, and hand your auditor a messier file than you need to.
Get this right once and every renewal after it gets faster, not harder. Choosing the right compliance framework for your business up front also saves you from mapping against the wrong control set entirely.
What you'll need
- A current asset register — devices, cloud accounts, data stores, third-party services
- Your existing IT control documentation: firewall rules, access policies, backup schedules, patch logs
- A copy of ISO 27001:2022 Annex A (93 controls across 4 themes: organisational, people, physical, technological)
- A risk assessment or risk register, even a basic one
- A spreadsheet or compliance platform to track the mapping — manual trackers work for under 20 controls, anything larger benefits from automation
- Two to three hours per week over 3-4 weeks for a team of one to three people
The steps
1. Pull your full Annex A control list
Start with the actual 2022 revision, not the older 2013 version — the control count dropped from 114 to 93 and several were merged or renamed. Working from the wrong list wastes the entire mapping exercise.
Expected outcome: a clean list of 93 controls grouped by theme, ready to check off.
Common mistake: teams still reference 2013-era control numbers (A.6, A.9, A.12) in 2026 documentation, which confuses auditors trained on the current structure.
2. Inventory what you already run
List every existing IT control you can name in 15 minutes: firewall configuration, endpoint protection, MFA policy, backup schedule, vendor access reviews, patch cadence. Don't filter yet — capture everything.
This step accomplishes the reverse-lookup that makes mapping fast. You're not starting from Annex A and building outward; you're starting from what exists and matching inward.
Expected outcome: a working list of 15-30 existing controls, unsorted.
3. Match each existing control to its Annex A equivalent
Go control by control through your inventory and tag which Annex A number it satisfies. A firewall configuration typically maps to A.8.20 (networks security) and A.8.21 (security of network services). An offboarding checklist maps to A.6.5 (responsibilities after termination).
Why it matters: this is the actual mapping — everything before it was preparation. Most teams find 60-70% of Annex A already covered by controls built for operational reasons, not compliance ones.
Expected outcome: each existing control assigned to one or more Annex A numbers.
Common mistake: forcing a loose match. If your patch policy doesn't actually cover vulnerability management timelines (A.8.8), don't tag it as covering that control — flag it as a gap instead.
4. Flag the genuine gaps
After mapping, list every Annex A control with no matching existing control. For most SMEs in 2026 this lands somewhere between 10 and 25 controls out of 93, often clustered in supplier relationships, threat intelligence, and secure development.
Why it matters: your Statement of Applicability needs an honest answer for every gap — either build the control, or document a justified exclusion.
Expected outcome: a short gap list with an owner and target date for each item.
5. Automate the evidence trail as you go
Manual screenshotting and folder-hunting is the single biggest time sink in ISO 27001 projects. As you confirm each mapping, connect the underlying system so evidence pulls automatically rather than being gathered by hand each audit cycle. Teams that automate evidence collection report far less scramble in the weeks before a surveillance audit.
Why it matters: an auditor doesn't just want the mapping — they want proof the control operated continuously, not just on the day you checked it.
Expected outcome: each mapped control linked to a live evidence source (log export, config screenshot, ticketing record).
6. Build your Statement of Applicability
The Statement of Applicability (SoA) is the document an auditor actually reads first. For all 93 Annex A controls, record: applicable or not, the justification, the mapped existing control (or new one), and its implementation status.
Expected outcome: a complete SoA covering all 93 controls with no blank justification fields.
Common mistake: marking a control not applicable without a reason tied to your actual risk assessment — auditors reject unjustified exclusions on sight.
7. Review the mapping with a second set of eyes
Have someone outside the mapping exercise — a manager, an external advisor, or a virtual CISO — sanity-check 10-15 mappings at random. Fresh eyes catch the loose matches from step 3 that the original mapper missed.
Expected outcome: a validated mapping ready to feed into your internal audit or Stage 1 assessment.
Automate your Annex A mapping
OneClickComply tracks control mapping and evidence in one place.
Troubleshooting
One existing control seems to satisfy five Annex A requirements. That's normal for broad controls like access management — tag all five, but check each one individually rather than assuming coverage by association.
You can't tell if a control counts as implemented or just documented. An Annex A control only counts as implemented if you have operating evidence — logs, tickets, config exports — not just a policy document sitting in a folder.
The gap list keeps growing the deeper you look. This is common in year one. Prioritise gaps by risk impact first, not by how easy they are to close — auditors care about risk-weighted remediation plans, not quick wins.
Two team members mapped the same control differently. Lock a single source-of-truth spreadsheet or platform before mapping starts. Parallel spreadsheets are the fastest way to end up with contradictory SoA entries.
You inherited a mapping from a previous consultant or platform. Don't trust it blind. Re-verify at least the technological theme controls (roughly 34 of the 93), since these change most often as infrastructure evolves.
Tools and resources
- Choosing the right compliance framework — confirm ISO 27001 is the right target before you map against it
- Automated evidence collection so evidence generates itself
- A current asset register and risk register (internal documents, not linked)
- ISO 27001:2022 Annex A control list (93 controls, 4 themes)
- A shared spreadsheet or compliance platform to prevent duplicate mapping work
What to do next
Once your mapping and SoA are locked, the next milestone is proving the controls held up over time. Read how to pass your ISO 27001 surveillance audit to see what auditors check first in year two and three.
Frequently asked questions
One last thing
The technological theme alone covers roughly a third of all 93 Annex A controls, and it's the theme most businesses already satisfy without realising it — a properly configured firewall, patch cycle and access log can knock out six or seven controls in one pass. Map that theme first in 2026 and the rest of the exercise moves faster than most teams expect.