ISO 27001 Control Assessment: A Clear Annex A Scoring Guide

An ISO 27001 control assessment is the part of any ISMS evaluation that scores the 93 Annex A controls of ISO/IEC 27001:2022 one by one: is the control applicable, is it implemented, is it operating as documented, and can that be shown. It is the largest single block of work in a self-assessment, a gap assessment or an internal audit, and it is the block auditors spend most of stage 2 on. The 2022 edition made it easier in one respect — 93 controls in four themes rather than 114 in fourteen — and richer in another, because ISO 27002:2022 gave every control five attributes that let the assessment be sliced by control type, security property or cybersecurity function. This guide explains how to score each control, what evidence each theme typically needs, how to use the attributes, and the controls that most often score lower than their owners expect.

What the ISO 27001 control assessment covers

The ISO 27001 control assessment covers Annex A of ISO 27001:2022, which lists 93 controls: A.5 organizational (37), A.6 people (8), A.7 physical (14) and A.8 technological (34). Eleven are new in 2022 — threat intelligence (A.5.7), cloud services (A.5.23), ICT readiness for business continuity (A.5.30), physical security monitoring (A.7.4), configuration management (A.8.9), information deletion (A.8.10), data masking (A.8.11), data leakage prevention (A.8.12), monitoring activities (A.8.16), web filtering (A.8.23) and secure coding (A.8.28) — and they are where organizations that transitioned by renaming their 2013 documents score worst. The controls are not mandatory individually: clause 6.1.3 requires the organization to compare its risk-treatment controls against Annex A, produce a Statement of Applicability listing the necessary controls with justification for inclusion and exclusion, and state whether each is implemented. The control assessment is the evidence behind that last column.

Scoring each control in the ISO 27001 control assessment

The ISO 27001 control assessment asks three questions per control, answered in order:

The score attaches to the control as the organization defined it. ISO 27002:2022 gives implementation guidance, not requirements; the organization’s own policy sets what “implemented” means for A.8.15 logging in its environment, and the assessment scores against that. A control with no organizational definition cannot score above 1, because there is nothing to be implemented against. Our guide to the ISO 27001 self-assessment covers the five-point scale in detail.

ISO 27001 control assessment evidence by theme

Using the ISO 27002 attributes

ISO 27002:2022 tags every control with five attributes, and an assessment that records them can be reported five ways from one dataset:

In an ISO 27001 control assessment the attributes cost nothing to record — they are fixed per control and published in ISO 27002 — and they turn a 93-row register into a management report. An average score by cybersecurity concept, for example, shows whether Detect and Respond are being funded. They also make the control assessment reusable for other frameworks: a NIST CSF 2.0 profile can be populated from the Identify-to-Recover view directly.

Controls that score lower than their owners expect

1. A.5.7 Threat intelligence. Reading vendor blogs is not a process. The control expects collection, analysis and use of threat information, with records that it changed something.
2. A.5.23 Cloud services. Requires a process for acquiring, using, managing and exiting cloud services, with security requirements in the agreements. Most organizations have the services and none of the process.
3. A.5.30 ICT readiness for business continuity. Requires ICT continuity planned, implemented, maintained and tested against business continuity objectives. A backup policy does not score above 2.
4. A.8.9 Configuration management. Documented baselines, enforced and reviewed. Environments built by hand score 1.
5. A.8.16 Monitoring activities. Networks, systems and applications monitored for anomalous behaviour with action taken. A SIEM nobody looks at is a 2.
6. A.5.19–A.5.22 Supplier controls. Agreements exist; the monitoring and review the controls require does not. Our guide to supplier security assessment covers what the evidence looks like.

From control assessment to the Statement of Applicability

The control assessment feeds the SoA directly: applicability and justification go into the first two columns, the implementation status into the third, and the evidence reference into the fourth column most organizations add for the auditor. Controls scored below 3 appear in the SoA as “not implemented” or “partially implemented” with a planned date, which is acceptable at stage 1 and rarely at stage 2. Keeping the assessment and the SoA in one register, re-scored on a cycle, gives the ISMS its clause 9.1 measurement for free. The results are presented through the ISO 27001 assessment report.

Frequently asked questions

How many controls does an ISO 27001 control assessment cover?
All 93 Annex A controls of ISO/IEC 27001:2022 — 37 organizational, 8 people, 14 physical, 34 technological — scored for applicability, implementation and evidence.

Are all 93 controls mandatory?
No. Clause 6.1.3 requires each to be considered and the Statement of Applicability to justify inclusion or exclusion. The clause 4–10 requirements are mandatory; the controls are selected through risk treatment.

What are the ISO 27002 attributes?
Five tags per control: control type, information security properties, cybersecurity concepts, operational capabilities and security domains. Recording them lets one assessment be reported by function, by property or by owner.

Which controls are new in 2022?
Eleven: A.5.7, A.5.23, A.5.30, A.7.4, A.8.9, A.8.10, A.8.11, A.8.12, A.8.16, A.8.23 and A.8.28. They are the ones most often scored low by organizations that transitioned by renaming their 2013 documents.

Can a control be scored implemented without a policy?
Rarely. A control needs an organizational definition of what implementation means before it can be assessed as implemented; a practice with no documented approach usually scores 2 at best.

Where this leaves you

Run the ISO 27001 control assessment as three questions per control — applicable, implemented, evidenced — across all 93, tag each with the ISO 27002 attributes, and keep the result in the same register as the Statement of Applicability. Look hardest at the eleven 2022 controls and the six that score low above; that is where the auditor will.

References

• ISO/IEC 27001:2022 — Annex A and clause 6.1.3.
• ISO/IEC 27002:2022 — Control guidance and the five attributes.

More on ISO 27001 assessment

• The ISO 27001 control assessment — you are here
• ISO 27001 self-assessment: scoring all 93 controls
• ISO 27001 gap assessment: the four outputs
• ISO 27001 maturity assessment: six levels
• Supplier security assessment under ISO 27001
• ISO 27001 assessment report: the six sections

A control-by-control questionnaire across all 93 Annex A controls and the clauses, with automatic scoring, risk analysis and summary dashboards, is what the Excel-based ISO 27001 Assessment Tool provides, or start with the free templates.