An SSP Annex A is a control-by-control implementation register, and the quality of an IRAP engagement turns on what’s in it.

The System Security Plan describes the system. The Annex A — the controls implementation matrix — describes how each ISM control applies to that system. Authorising officers, assessors, and downstream agencies all rely on it as the spine of evidence. When the Annex A is thin, every other artefact tilts.

What belongs in each row, in order:

The control identifier and the ISM revision it maps against. Annexes built against an older ISM revision silently break the report when controls are renumbered or retired. State the revision once at the top, and verify it against the current March 2026 release before submitting.

An applicability statement. Applicable, not applicable, or alternately controlled — with a one-line justification. “Not applicable because the system processes no cryptographic material” is acceptable; “Not applicable” alone is not.

An implementation statement that names the actual mechanism. Not “controls are in place” but “Account-level IAM password policy enforces a 14-character minimum, MFA on all human identities, 90-day rotation”. Specific. Reviewable. Falsifiable.

A pointer to evidence. The Annex A is a navigation index. Each cell should point at a screenshot, configuration export, log query, attestation, or an inherited control documented elsewhere. If the pointer goes nowhere, the control isn’t documented — it’s asserted.

Inheritance and shared responsibility. Where a control is inherited from a cloud provider already on the IRAP register, name the provider, name the control on their side, and reference the underlying assessment date. Inheritance without provenance is a smell.

Residual risk and accepted-by. Where the control is partial, what is the residual risk, who has accepted it, and on what date. An assessor reading an Annex A without an accepted-by column will write that absence into the report.

A consistent voice. One author, or a strict editorial pass. Annexes written by five different engineers in five different styles bleed assessor time and create internal contradictions.

What it is not. The Annex A is not the SSP body, not the SRMP, and not a place to explain architecture. It is a register; keep it terse.

TrustedZone’s Director, an ASD-endorsed assessor operating to the PROTECTED ceiling, sees the same failure recur: vendors treating Annex A as a checklist instead of an index. The assessor’s first read of an Annex A predicts the duration of the entire Stage 2 engagement.

Takeaway. If a row in your Annex A doesn’t point at evidence, it’s not a row — it’s a gap in disguise.

Published by TrustedZone news automation on 2026-05-16 AEST. Director rollback.