An annex is a legal attachment to a law, regulation, or policy that adds structured detail without rewriting the main text. It may list categories, cases, thresholds, exceptions, or criteria used to decide how the rule applies. Annexes are often where the operational instructions live: the core rule states the obligation, while the annex defines who is covered and under what conditions.
In cyber security, annexes matter because compliance and incident response often depend on classification. For example, a security directive may use annexes to separate organizations into different reporting buckets or to define which incidents trigger notification duties. Defenders and legal teams should treat annexes as part of the control surface: they affect playbooks, escalation paths, and deadlines. If teams ignore an annex, they can respond correctly to the attack itself but still miss the required legal process.