LTS Episode 2025_06
Demystifying Annex A: First Steps in Understanding ISO 27001 Controls
In this episode of 'Leading the Standard,' hosts Kelly Taylor and Jackie Stapleton delve into Annex A of ISO 27001, breaking down the intimidating list of 93 controls into accessible and relatable components. They explore four main categories: organizational controls, people controls, physical controls, and technological controls. Jackie shares insights and anecdotes from her experience, including how businesses and consumers unknowingly interact with these controls daily. Highlights include encryption, access management, and employee security training. This episode is a primer for beginners looking to grasp the fundamentals of ISO 27001 and its application in real-world scenarios.
Timestamps of Interest:
• 00:00 Introduction to Annex A and ISO 27001
• 00:41 Meet the Hosts: Kelly and Jackie
• 00:50 Recap and Focus on Annex A
• 01:11 Breaking Down the Four Controls
• 02:35 Jackie's Perspective on Annex A
• 15:33 Policy Development and Risk Management
• 24:45 Encryption and Technological Controls
• 32:43 Husband Tracker and Banking Mishaps
• 33:32 Consumer Exposure to Encryption and Data Protection
• 34:58 Role of Technical Experts in Security
• 36:14 Access Management and MFA
• 37:44 Password Management and Security
• 44:05 Security Training and Incident Response
• 52:33 Summary and Final Thoughts
Links we promised:
• LTS Newsletter on LinkedIn:
• Jackie Stapletons LinkedIn page: https://www.linkedin.com/in/jackiestapleton/
• Kelly Taylors LinkedIn page: https://www.linkedin.com/in/kellytaylor-au/
• Dr. Georg Thomas LinkedIn page: https://www.linkedin.com/in/georgthomas/
• Dr Georges Google Scholar page: https://scholar.google.com/citations?user=z72s_9MAAAAJ&hl=en
• ISO 27001 ROI Page: https://auditortrainingonline.com/home/category/iso-27001-information-security
Disclaimer: This podcast is intended for guidance purposes only. While we strive to provide accurate and up-to-date information, the recommendations given should be considered as suggestions rather than definitive advice. Auditor Training Online (ATOL) cannot be held responsible for any decisions made based on this guidance. Always consult with a professional for specific advice tailored to your business circumstances.
© Auditor Training Online Pty Ltd 2025. All Rights Reserved | www.auditortrainingonline.com