Physical Enforcement of Annex A Controls
ISO 27001 requires organisations to implement appropriate controls from Annex A. Control provides physical enforcement for network segmentation, access control, and business continuity controls that demonstrate a higher standard of protection.
ISO 27001
ISO 27001 certification demonstrates intent. Physical control enforcement demonstrates reality. The gap between the two is where breaches happen.
14
Annex A controls with physical enforcement
100%
Network segmentation physical evidence
A.8
Technology controls with physical backing
Full
Continuous ISMS evidence generation
Demonstrating control effectiveness is difficult.
Point-in-Time Audits
ISO 27001 surveillance audits capture a snapshot. Between audits, control effectiveness can degrade through configuration drift, human error, or undocumented changes.
Network Control Evidence
Demonstrating continuous network segmentation effectiveness requires evidence that logical controls have been maintained without interruption.
Access Control Gaps
Access reviews happen periodically, but between reviews, excessive access can accumulate as roles change and projects begin and end.
The Scenario
Scenario: Surveillance Audit with Physical Evidence
During an ISO 27001 surveillance audit, the auditor examines network segmentation controls under Annex A.8.22 (Network segmentation). The organisation presents twelve months of continuous physical boundary state logs showing unbroken zone separation. Every conduit activation is documented with multi-party authorisation records, time stamps, and data flow logs. The auditor notes that this level of continuous evidence exceeds what they typically see with software-only implementations, where gaps between configuration audits leave uncertainty about control effectiveness. With Control, the evidence is irrefutable. Physical boundaries were maintained continuously, and every exception was explicitly authorised and logged.
"Our previous auditor accepted our firewall rules as evidence of network segmentation. Our new auditor asked how we knew the rules had been continuously correct between audits. We could not answer that question with software-only controls."
Where ISO 27001 Annex A controls meet Control modules.
ISO 27001:2022 reorganised Annex A into 93 controls across four themes. Control provides the physical and operational enforcement for the technological and people-facing controls that hold the boundary.
Reference: ISO/IEC 27001:2022 Annex A, themed under Organisational, People, Physical and Technological controls.
Organisational controls
-
A.5.14
Information transfer
Outbound and inter-zone data movement is a governed Transfer event with inventory and evidence.
Transfer
Validate -
A.5.15
Access control
Reach is named, scoped and time-bound, not standing.
Lock
Relay -
A.5.16
Identity management
Departures and changes revoke standing trust at the boundary.
Unlink
People controls
-
A.6.8
Information security event reporting
Reportable events are captured in tamper-evident form and sealed offline.
ArchiveValidate
Technological controls
-
A.8.13
Information backup
Backups live in an offline vault that is not reachable on the live network.
ArchiveTransfer -
A.8.16
Monitoring activities
Continuous attestation of conduit and vault state, signed and stored offline.
Validate -
A.8.20
Network security
Zone boundaries are physically severed by default.
Firebreak
Isolate -
A.8.22
Segregation of networks
Cross-zone reach is a named Relay session, not a permanent route.
IsolateRelay
Modules & symbols
TransferControlled moveValidateIntegrity checkLockNamed accessRelayTime-bound pathUnlinkRemove trustArchiveDisconnected copyFirebreakPhysical severIsolateZone boundaryFeatured In
Key Capabilities
Physical Control Enforcement
Annex A controls are enforced physically, providing a higher standard of protection than software-only implementations.
Access Control Evidence
Every access authorisation, session, and revocation is documented in tamper-proof logs for ISMS records.
Continuous ISMS Evidence
Automated logging generates continuous evidence for Statement of Applicability controls, eliminating gaps between surveillance audits.
Segmentation Assurance
Physical network segmentation provides irrefutable evidence of zone separation for A.8.22 compliance.
Audit-Ready Documentation
Tamper-proof logs and automated reports provide complete audit trails ready for certification and surveillance audits.
Recovery Assurance
Verified control-plane baselines demonstrate ICT readiness for business continuity beyond what network-connected systems can provide.
Demo to Live
Adoption Guide
SoA Mapping Assessment
Map your Statement of Applicability against Control module capabilities to identify where physical enforcement strengthens your ISMS.
Control Architecture Design
Design physical enforcement for priority Annex A controls, starting with network segmentation and access control.
Pre-Audit Validation
Deploy and validate continuous evidence generation before your next surveillance audit to demonstrate physical control effectiveness.
ISMS Integration
Full integration with your ISMS including continuous evidence generation, automated reporting, and tamper-evident compliance record preservation.
SoA Mapping Assessment
Map your Statement of Applicability against Control module capabilities to identify where physical enforcement strengthens your ISMS.
Control Architecture Design
Design physical enforcement for priority Annex A controls, starting with network segmentation and access control.
Pre-Audit Validation
Deploy and validate continuous evidence generation before your next surveillance audit to demonstrate physical control effectiveness.
ISMS Integration
Full integration with your ISMS including continuous evidence generation, automated reporting, and tamper-evident compliance record preservation.
Explore More
NIS2 Framework
Operational resilience for essential and important entities.
Learn more about NIS2 FrameworkCyber Essentials
UK baseline certification with physical isolation evidence.
Learn more about Cyber EssentialsNIST CSF Framework
Identify, protect, detect, respond, recover alignment.
Learn more about NIST CSF FrameworkQuestions