Annex A controls and the certification journey¶
The controls, and why each one exists¶
ISO 27001's reference controls live in Annex A. The 2022 revision lists 93 controls, grouped into four themes rather than the older long list of domains:
| Theme | Roughly covers | A Scaldimet example, and the risk it reduces |
|---|---|---|
| Organizational | Policies, supplier relationships, access policy | Supplier relationships bind the OT vendors to security duties and get them assessed (Chapter 4.8, TPRM); separately, the access-control policy governs how the contractor connects to the OT (an access control) |
| People | Screening, awareness, responsibilities | Awareness training, reducing the risk that staff at either site enable phishing or mishandle data |
| Physical | Premises, equipment, media | Controlling physical access to the Beta plant floor, reducing tampering with controllers |
| Technological | Access control, logging, cryptography, backups | Logging and monitoring, so the contractor's remote sessions are recorded and reviewable |
The discipline that matters here is that each control is understood through its risk rationale. You adopt the baseline as a whole, but you never treat a control as a box to tick: you keep sight of the risk each one addresses. "Monitoring and logging" is in the baseline, and for Scaldimet its rationale is concrete, the contractor reaching Beta's unmonitored OT is a real risk, and logging is how you would detect misuse. Keeping that rationale visible is what lets you prioritise the control, test whether it actually reduces the risk, and justify it (or an exclusion) in the Statement of Applicability. A control treated as "just something the standard says" can do none of those.
Equally, controls can be excluded, with justification. If Scaldimet does no in-house software development, the secure-development controls can be marked not applicable in the SoA. Exclusion with a reason is legitimate; omitting a control without justification is not.
The certification journey¶
The customer wants the certificate, so you need to know how one is obtained. Certification is granted by an accredited certification body (an independent auditor), not by ISO itself, and it follows a defined path:
- Prepare. Build and operate the ISMS, run the risk assessment, produce the SoA, and let the controls run long enough to generate evidence.
- Stage 1 audit. The certification body reviews your documentation and readiness: is the ISMS designed, is the SoA coherent, are you ready for a real audit? It identifies gaps before they cost you.
- Stage 2 audit. The body tests whether the ISMS is actually operating: it samples evidence that controls are performed, not merely written down. This is where design effectiveness and operating effectiveness (Lesson 3.6) are properly tested.
- Certification. If conformity is demonstrated, the certificate is issued, valid for three years.
- Surveillance and recertification. The body returns for surveillance audits (typically annually) and a full recertification at the three-year mark. Certification does not replace the need to operate and continually improve the ISMS.
Findings are graded. A major nonconformity (a whole requirement missing or a control systematically not working) blocks or suspends certification until fixed; a minor nonconformity requires a corrective-action plan. The realistic Scaldimet planning point is timing: a credible ISMS plus Stage 1 and Stage 2 takes months, so the certification timeline has to be set against the OEM's contract-renewal deadline, and started early.
Application: an exclusion decision, and a certification timeline¶
You will not have the ISO 27001 standard to hand (it is a paid document), and you do not need it here: the reasoning works from the free frameworks the course uses and from Scaldimet's own facts.
-
A Statement of Applicability decision. Scaldimet adopts CyFun Important as a whole; the SoA records inclusions and, above all, justifies exclusions. Name (a) one area Scaldimet can legitimately mark not applicable, with the reason, and (b) one area it might be tempted to exclude but must not, and why.
-
A certification timeline. Suppose the OEM contract renews in nine months. Working backwards from that date, list the milestones the certificate depends on (build and operate the ISMS long enough to generate evidence, Stage 1 readiness review, Stage 2 operating audit, certificate) and name the one thing that must start now.
Model answer (open after you've drafted yours)
A workable answer to (1): (a) the secure-development controls, marked not applicable because Scaldimet writes no software in-house, recorded in the SoA rather than silently omitted; (b) the OT and production systems, or the contractor's access, which it is tempting to scope out as "just the factory" or "the vendor's kit", but that is exactly where Scaldimet's crown-jewel risk lives. Excluding it would repeat the scope mistake of Lesson 3.3.A and hand the customer a certificate that misses what they care about. When you adopt a baseline as a whole, the SoA's real decisions are the exclusions. Excluding those areas would reduce the relevance of the certification to the risks and activities the customer expects it to cover.
For (2): the binding constraint is that Stage 2 can only sample evidence that controls have been operating for a while, so a credible certificate takes months, not weeks. Working back from nine months, the controls have to start running almost immediately; the audit stages cannot be compressed at the end. The one thing to start now is operating the baseline, so there is evidence to audit later.
Key takeaway
ISO 27001's Annex A offers 93 reference controls in four themes (organizational, people, physical, technological), and the key discipline is that each is understood through its risk rationale, recorded in the Statement of Applicability, which also justifies any exclusions. Certification comes from an accredited body through a Stage 1 readiness review and a Stage 2 operating audit, yields a three-year certificate, and is sustained by surveillance audits, with major nonconformities blocking certification. For Scaldimet, the certification timeline must be planned backwards from the customer's deadline.