Question:An organization has implemented additional controls from other sources alongside the ISO/IEC 27001 Annex A...

ISO/IEC 27001:2022 clause 6.1.3 (Information Security Risk Treatment) explicitly states:

"Organizations can design controls as required or identify them from any source."

Annex A provides a reference list, but it is not exhaustive. Organizations are encouraged to adopt additional controls if they are needed based on the results of risk assessment or contextual relevance. This supports flexibility and context-based tailoring of the ISMS.