ISO/IEC 27002:2022 - Annex A

Annex A: what a GRC tool can honestly carry

Ninety-three controls. eramba runs none of your firewalls and encrypts none of your disks. But every technical control still needs a policy, an owner, a test and evidence - and that is the part it does carry, for all ninety-three.

Import the ISO 27002 package See the four themes

Pairs with the ISO 27001 guide
Free CSV download
Every framework included

Four themes, 93 controlsISO/IEC 27002:2022

Organisational37 controls
People8 controls
Physical14 controls
Technological34 controls

eramba is where the control livesyou run it, eramba governs it

Two ways a control can sit in eramba

The green part of each bar is the set of controls where eramba is the system of record - the control is performed in it. Everything else is a control you run elsewhere, which eramba still owns the policy, the schedule, the test result and the evidence for.

Where eramba is the control

5.1 Policies for information security, written, approved and published on the policy portal
5.8 Information security in project management
5.9 Inventory of information and associated assets
5.12 Classification of information
5.18 Access rights, reviewed by the people who own them
5.19-5.21 Supplier relationships, agreements and the ICT supply chain
5.24-5.28 Incident planning, assessment, response, lessons learned and evidence
5.30-5.37 Continuity readiness, legal requirements, records, privacy, independent review and procedures
6.3 Awareness, education and training
8.2 · 8.14 Privileged access review and redundancy documentation

Where eramba governs the control

The other seventy controls are yours to operate: firewalls, encryption, backups, physical entry, secure development. eramba does not touch them.

What an auditor asks for, though, is not the firewall. It is the policy that mandates it, the person who owns it, the test that proves it worked last quarter, and the finding that was raised when it did not. All of that is a control record here, with its own schedule.

That is why the physical theme shows no green at all and still matters: eramba has no opinion about your door locks, but it is where the evidence that they were checked lives.

eramba and ISO 27002 (2022) - the full guide

Your Statement of Applicability

Annex A exists to be selected from. For each of the ninety-three controls you say whether it applies, and if it does not, why - which is a compliance exception with an owner and a deadline, not a blank cell.

In eramba the Statement of Applicability comes out of Compliance Analysis, where each control already carries its linked risks, policies and internal controls. It is a report, not a spreadsheet someone maintains by hand.

Compliance analysis for the ISO package showing each control with its strategy, internal controls and policies — Compliance Analysis for the ISO package: each control with its strategy, its linked controls and policies, and its status.

The technical controls are the ones people oversell

Thirty-four of the ninety-three controls are technological. It is tempting for any GRC vendor to imply it covers them, because the list looks impressive on a page.

It does not. eramba cannot configure a firewall, rotate a key or patch a server. What it can do is make sure somebody owns each of those, that they are tested on a schedule you set, and that the failure opens a finding instead of disappearing.