Finding your way around 93 controls

The themes are organisational (37 controls), people (8), physical (14) and technological (34). That grouping is about where a control lives rather than what it does, which is why scanning by theme works when you are checking coverage and works badly when you are trying to treat a specific risk.

The useful structure is in ISO/IEC 27002:2022 — the guidance companion, not the Annex A list itself, and the distinction matters because people look for this in the wrong document. It tags every control with five attributes: control type (preventive, detective, corrective); information security properties (confidentiality, integrity, availability); cybersecurity concepts (identify, protect, detect, respond, recover, which line up with the NIST functions); operational capabilities; and security domains.

Those tags are explicitly not requirements — nobody audits your use of them. They exist so you can slice the list: every detective control, everything touching availability, everything in the respond phase. That is how you answer "what do we have covering this?" without reading all 93 in order, and it is the fastest route into the set for anyone meeting it for the first time.