Learn about controls in ISO 27001, cover all 93 controls in Annex A, and find out how to start with your ISO 27001 implementation project from a practical perspective with examples of audit evidence.
ISO/IEC 27001:2022 offers a model for establishment, implementation, maintenance, and continual improvement of an ISMS. Annex A lists 93 controls related to information security arranged by four areas: organizational, people, physical, and technological.
ISO 27001 controls are security measures used to address information security risks within an organization.
Annex A of ISO/IEC 27001:2022 contains 93 controls across four themes:
Annex A is a reference set used alongside the organization’s risk assessment. The controls that apply to your organization should be determined based on your risks and documented in the Statement of Applicability (SoA).
37 controls covering governance, policies, suppliers, incident management, business continuity, and compliance.
| Control | Purpose |
|---|---|
| A.5.1 Policies for information security | Establish and maintain information security policies. |
| A.5.2 Information security roles and responsibilities | Define security responsibilities and ownership. |
| A.5.3 Segregation of duties | Separate conflicting responsibilities to reduce security risks. |
| A.5.4 Management responsibilities | Ensure management supports and enforces security requirements. |
| A.5.5 Contact with authorities | Maintain appropriate relationships with relevant authorities. |
| A.5.6 Contact with special interest groups | Maintain security knowledge through relevant communities and groups. |
| A.5.7 Threat intelligence | Collect and use information about security threats. |
| A.5.8 Information security in project management | Integrate security into project planning and execution. |
| A.5.9 Inventory of information and other associated assets | Maintain an accurate inventory of information and assets. |
| A.5.10 Acceptable use of information and other associated assets | Define acceptable use requirements for information and assets. |
| A.5.11 Return of assets | Ensure organizational assets are returned when employment or contracts end. |
| A.5.12 Classification of information | Classify information according to its security requirements. |
| A.5.13 Labelling of information | Apply appropriate labels to classified information. |
| A.5.14 Information transfer | Protect information when it is transferred. |
| A.5.15 Access control | Define and enforce appropriate access requirements. |
| A.5.16 Identity management | Manage identities throughout their lifecycle. |
| A.5.17 Authentication information | Protect passwords, keys, and other authentication information. |
| A.5.18 Access rights | Manage, review, and revoke access rights appropriately. |
| A.5.19 Information security in supplier relationships | Manage information security risks from suppliers. |
| A.5.20 Addressing information security within supplier agreements | Include security requirements in supplier contracts. |
| A.5.21 Managing information security in the ICT supply chain | Address security risks across the ICT supply chain. |
| A.5.22 Monitoring, review and change management of supplier services | Monitor supplier performance and security changes. |
| A.5.23 Information security for use of cloud services | Manage security when acquiring and using cloud services. |
| A.5.24 Information security incident management planning and preparation | Establish processes and responsibilities for incident response. |
| A.5.25 Assessment and decision on information security events | Assess events and determine whether they are security incidents. |
| A.5.26 Response to information security incidents | Respond to and manage security incidents effectively. |
| A.5.27 Learning from information security incidents | Use incidents to improve security controls and processes. |
| A.5.28 Collection of evidence | Collect and preserve evidence related to security incidents. |
| A.5.29 Information security during disruption | Maintain information security during business disruptions. |
| A.5.30 ICT readiness for business continuity | Ensure ICT supports business continuity requirements. |
| A.5.31 Legal, statutory, regulatory and contractual requirements | Identify and manage applicable security obligations. |
| A.5.32 Intellectual property rights | Protect intellectual property and licensing rights. |
| A.5.33 Protection of records | Protect important records from loss or unauthorized access. |
| A.5.34 Privacy and protection of PII | Protect personally identifiable information and meet privacy obligations. |
| A.5.35 Independent review of information security | Conduct independent reviews of information security. |
| A.5.36 Compliance with policies, rules and standards for information security | Verify that security requirements are being followed. |
| A.5.37 Documented operating procedures | Document important security-related operating procedures. |
8 controls focused on employee security, awareness, remote working, and responsibilities.
| Control | Purpose |
|---|---|
| A.6.1 Screening | Conduct appropriate background checks before employment. |
| A.6.2 Terms and conditions of employment | Define information security responsibilities in employment agreements. |
| A.6.3 Information security awareness, education and training | Train employees to understand and follow security practices. |
| A.6.4 Disciplinary process | Establish a process for handling security policy violations. |
| A.6.5 Responsibilities after termination or change of employment | Maintain security responsibilities after role changes or termination. |
| A.6.6 Confidentiality or non-disclosure agreements | Protect confidential information through appropriate agreements. |
| A.6.7 Remote working | Protect information accessed or processed while working remotely. |
| A.6.8 Information security event reporting | Provide clear processes for reporting security events. |
14 controls focused on facilities, equipment, physical access, and environmental protection.
| Control | Purpose |
|---|---|
| A.7.1 Physical security perimeters | Protect areas containing sensitive information and assets. |
| A.7.2 Physical entry | Control physical access to secure areas. |
| A.7.3 Securing offices, rooms and facilities | Protect offices and facilities from unauthorized access. |
| A.7.4 Physical security monitoring | Monitor facilities for unauthorized physical activity. |
| A.7.5 Protecting against physical and environmental threats | Protect against threats such as fire, flood, and power failures. |
| A.7.6 Working in secure areas | Establish security requirements for working in secure areas. |
| A.7.7 Clear desk and clear screen | Prevent sensitive information from being exposed when unattended. |
| A.7.8 Equipment siting and protection | Position and protect equipment appropriately. |
| A.7.9 Security of assets off-premises | Protect organizational equipment and information outside facilities. |
| A.7.10 Storage media | Secure storage media throughout its lifecycle. |
| A.7.11 Supporting utilities | Protect systems from utility failures. |
| A.7.12 Cabling security | Protect power and telecommunications cabling. |
| A.7.13 Equipment maintenance | Maintain equipment securely and appropriately. |
| A.7.14 Secure disposal or re-use of equipment | Ensure equipment and storage media are securely disposed of or reused. |
34 controls covering endpoints, access, cryptography, networks, software development, logging, and monitoring.
| Control | Purpose |
|---|---|
| A.8.1 User endpoint devices | Protect laptops, phones, and other endpoint devices. |
| A.8.2 Privileged access rights | Restrict and manage administrative access. |
| A.8.3 Information access restriction | Restrict access to information based on requirements. |
| A.8.4 Access to source code | Protect source code from unauthorized access. |
| A.8.5 Secure authentication | Implement secure authentication mechanisms. |
| A.8.6 Capacity management | Monitor capacity to support system availability. |
| A.8.7 Protection against malware | Prevent, detect, and respond to malware. |
| A.8.8 Management of technical vulnerabilities | Identify and address technical vulnerabilities. |
| A.8.9 Configuration management | Maintain secure configurations for systems and technology. |
| A.8.10 Information deletion | Delete information when it is no longer required. |
| A.8.11 Data masking | Protect sensitive data through masking or similar techniques. |
| A.8.12 Data leakage prevention | Prevent unauthorized disclosure or transfer of information. |
| A.8.13 Information backup | Maintain and test appropriate backups. |
| A.8.14 Redundancy of information processing facilities | Provide appropriate redundancy for availability. |
| A.8.15 Logging | Generate and protect relevant security logs. |
| A.8.16 Monitoring activities | Monitor systems and applications for suspicious activity. |
| A.8.17 Clock synchronization | Synchronize system clocks to support reliable logging. |
| A.8.18 Use of privileged utility programs | Restrict and control powerful system utilities. |
| A.8.19 Installation of software on operational systems | Control software installation on operational systems. |
| A.8.20 Networks security | Protect networks and network infrastructure. |
| A.8.21 Security of network services | Establish security requirements for network services. |
| A.8.22 Segregation of networks | Separate networks according to security requirements. |
| A.8.23 Web filtering | Control access to potentially harmful websites. |
| A.8.24 Use of cryptography | Establish appropriate cryptography and key-management practices. |
| A.8.25 Secure development life cycle | Integrate security throughout software development. |
| A.8.26 Application security requirements | Define security requirements for applications. |
| A.8.27 Secure system architecture and engineering principles | Apply secure-by-design principles to systems. |
| A.8.28 Secure coding | Apply secure coding practices during software development. |
| A.8.29 Security testing in development and acceptance | Test security before systems are released. |
| A.8.30 Outsourced development | Manage security requirements for outsourced development. |
| A.8.31 Separation of development, test and production environments | Separate environments to reduce security risks. |
| A.8.32 Change management | Control and document changes to systems. |
| A.8.33 Test information | Protect information used for testing. |
| A.8.34 Protection of information systems during audit testing | Protect systems and information during audit activities. |
ISO 27001 implementation should start with understanding your organization’s risks rather than simply checking every Annex A control as completed.
Determine which people, systems, locations, processes, and information are covered.
Identify information security risks and determine appropriate treatment.
Compare your necessary controls with Annex A and determine which controls apply.
Document which controls are applicable, their implementation status, and the justification for exclusions.
Put the controls into operation and maintain evidence that they are working.
Consider an ISMS review in advance of certification audit.
The ISO auditing guidelines clearly state that Annex A is meant to be applied alongside the risk treatment process and Statement of Applicability, not as a checklist applicable for all circumstances.
Auditors typically look for evidence that relevant controls are implemented and operating, not simply documented.
Common evidence can include:
The exact evidence required depends on your ISMS scope, risks, applicable controls, and audit context.
Don’t implement controls simply because they appear in Annex A. Determine what your organization actually needs based on risk and applicable obligations.
Maintain evidence continuously instead of trying to collect everything immediately before an audit.
Every applicable control should have clear ownership and responsibility.
Automation for compliance can aid in collecting evidence, control monitoring, policies, risk management, and audits.
The security landscape at your organization evolves as you do.
SOCLY.io assists companies with ISO 27001 implementation by automating compliance activities.
With SOCLY.io, you can streamline:
There are 93 controls in the ISO/IEC 27001:2022 Annex A which are classified under four broad themes; Organizational, People, Physical, and Technological.
No. The organizations choose the controls depending upon their risk treatment approach.
The four Annex A themes are Organizational, People, Physical, and Technological, containing 37, 8, 14, and 34 controls, respectively.
The SoA contains details about the controls that have been identified as relevant for the company’s ISMS, along with their implementation status and rationale for exclusion.
ISO/IEC 27001 standard provides requirements for ISMS, whereas ISO/IEC 27002 standard provides guidelines for implementing information security controls.
Define the scope of your ISMS, perform a risk assessment, choose appropriate controls, prepare SoA, implement controls, gather evidence, and conduct internal review prior to the certification audit.
Develop your ISMS, manage your Annex A controls, gather evidence, and prepare for your certification audit using SOCLY.io.
Your trusted partner in compliance automation. Turn complex regulations into clear, automated workflows.
By submitting, you agree to our Privacy Policy and Terms of Service
