The Annex A remap

Annex A is a table of audit guidance, one row for each clause of ISO/IEC 27001, not a list of controls. The 2020 table follows the 2013 clauses 4 to 10. The 2022 edition keeps the same clause numbers for most of the structure but changes the content in several places: a climate change decision in 4.1, monitorable objectives in 6.2, a new 6.3 Planning of changes, criteria and change control in 8.1, a split internal audit clause in 9.2, and the swap of continual improvement to 10.1 and nonconformity to 10.2.

The control annex changed more visibly. The 2013 Annex A had 114 controls in 14 sections; the 2022 Annex A has 93 controls in four themes (organisational, people, physical and technological). The Statement of Applicability therefore has a different shape, and an audit that samples the old 114-control list will miss controls that are new and test controls that no longer exist in the same form.

This site keeps the 2020 row numbering for traceability and adds the 2022 clause number to every page. The rows that changed are marked. The new 6.3 row is added as A.3.3 and labelled as a new row, because the DIS annex numbering is not public. A reader who needs the exact DIS numbering should check the published text when it appears.

What to keep

• The Statement of Applicability against the 2022 93-control set
• A crosswalk from the 2020 annex rows to the 2022 clauses
• A corrected reference list in the audit procedure

Common gaps

• The SoA still uses the 2013 114-control structure
• The internal audit procedure cites 2013 clause numbers
• No row for 6.3 Planning of changes

What this means for your programme

Put the change in the programme record with a date, an owner and the source you checked. Do not rewrite the whole procedure on the strength of a draft. The kit's crosswalk and dated plan are built for this: one row per clause or annex row, with the current position and the draft position side by side.

This page is our reading of the public record. The DIS body is not public in full. Where a statement depends on the 19011:2026 change summary rather than on the DIS text, the page says so.