ISO 27001 Annex A Controls Explained: All 93 Controls in Plain English
Cybergen InsightsCREST-certified security team
|
|
10 min read
Annex A is the part of ISO 27001 most people picture when they think of the standard: a long list of security controls. It is also the part most often misunderstood. Annex A is not a checklist you must complete in full, and it is not the whole standard. It is a reference set of 93 controls that you choose from, based on the risks your organisation actually faces.
This guide explains how Annex A works, walks through all four themes in plain English, lists every one of the 93 controls with the eleven new ones highlighted, and shows how to decide which ones apply to you. For help putting them into practice, see our ISO 27001 certification and consultancy service.
What Annex A Is, and What It Is Not
ISO/IEC 27001 has two parts. Clauses 4 to 10 set out the mandatory requirements for running an information security management system. Annex A provides a list of information security controls that you use when deciding how to treat your risks.
The standard asks you to compare the controls you have chosen against Annex A to make sure nothing important has been missed. You then record every one of the 93 controls in your Statement of Applicability, saying whether it applies, why, and whether it is implemented. That is the requirement. Nothing in the standard says all 93 must be in place.
Annex A also gives only a one line description of each control. The detail on how to implement them lives in the companion standard, ISO/IEC 27002:2022, which provides guidance, purpose statements and attributes for every control. You are certified against ISO 27001, not ISO 27002, but most implementers keep both to hand. Our clause by clause ISO 27001 requirements guide explains how Annex A connects to the rest of the standard.
The Four Themes
The 2022 edition reorganised the old fourteen domains into four themes. The themes are simply a way of grouping controls by what they apply to.
How the 93 controls are split
Organisational Controls (5.1 to 5.37)
The largest theme covers how the organisation governs and manages security. It includes policies and roles, asset management and classification, access control and identity, supplier and cloud security, incident management, business continuity, and legal and regulatory compliance.
In practice, these are the controls that shape everything else. Get access control (5.15 to 5.18) and supplier security (5.19 to 5.23) right and many technical controls become easier. Incident management (5.24 to 5.28) is also where auditors expect to see real records, not just a procedure.
Show all 37 organisational controls
- 5.1 Policies for information security
- 5.2 Information security roles and responsibilities
- 5.3 Segregation of duties
- 5.4 Management responsibilities
- 5.5 Contact with authorities
- 5.6 Contact with special interest groups
- 5.7 Threat intelligence New in 2022
- 5.8 Information security in project management
- 5.9 Inventory of information and other associated assets
- 5.10 Acceptable use of information and other associated assets
- 5.11 Return of assets
- 5.12 Classification of information
- 5.13 Labelling of information
- 5.14 Information transfer
- 5.15 Access control
- 5.16 Identity management
- 5.17 Authentication information
- 5.18 Access rights
- 5.19 Information security in supplier relationships
- 5.20 Addressing information security within supplier agreements
- 5.21 Managing information security in the ICT supply chain
- 5.22 Monitoring, review and change management of supplier services
- 5.23 Information security for use of cloud services New in 2022
- 5.24 Information security incident management planning and preparation
- 5.25 Assessment and decision on information security events
- 5.26 Response to information security incidents
- 5.27 Learning from information security incidents
- 5.28 Collection of evidence
- 5.29 Information security during disruption
- 5.30 ICT readiness for business continuity New in 2022
- 5.31 Legal, statutory, regulatory and contractual requirements
- 5.32 Intellectual property rights
- 5.33 Protection of records
- 5.34 Privacy and protection of personally identifiable information
- 5.35 Independent review of information security
- 5.36 Compliance with policies, rules and standards for information security
- 5.37 Documented operating procedures
People Controls (6.1 to 6.8)
The people theme follows the employee lifecycle: screening before joining, terms of employment, awareness training, a disciplinary process, responsibilities on leaving and confidentiality agreements. It also covers remote working and making sure staff know how to report security events.
Awareness training (6.3) is one of the most commonly sampled controls at audit. Auditors will often pick a handful of staff at random and ask for their training records, so make sure records exist for everyone in scope, including new starters. Our security awareness and phishing simulation service is designed to produce exactly this evidence.
Show all 8 people controls
- 6.1 Screening
- 6.2 Terms and conditions of employment
- 6.3 Information security awareness, education and training
- 6.4 Disciplinary process
- 6.5 Responsibilities after termination or change of employment
- 6.6 Confidentiality or non-disclosure agreements
- 6.7 Remote working
- 6.8 Information security event reporting
Physical Controls (7.1 to 7.14)
Physical controls protect premises, equipment and storage media. They cover perimeters and entry, secure offices and areas, clear desk and screen, equipment siting, maintenance and secure disposal.
For cloud first organisations with small offices, many physical controls will be lighter than for an organisation running its own data centre, and some responsibilities transfer to cloud and hosting providers. That does not remove them from scope. You still need to show how you rely on, and check, your providers' physical security.
Show all 14 physical controls
- 7.1 Physical security perimeters
- 7.2 Physical entry
- 7.3 Securing offices, rooms and facilities
- 7.4 Physical security monitoring New in 2022
- 7.5 Protecting against physical and environmental threats
- 7.6 Working in secure areas
- 7.7 Clear desk and clear screen
- 7.8 Equipment siting and protection
- 7.9 Security of assets off-premises
- 7.10 Storage media
- 7.11 Supporting utilities
- 7.12 Cabling security
- 7.13 Equipment maintenance
- 7.14 Secure disposal or re-use of equipment
Technological Controls (8.1 to 8.34)
The technological theme covers the technical safeguards most people associate with cyber security: endpoint protection, privileged access, secure authentication, malware protection, vulnerability management, backups, logging and monitoring, network security, cryptography and secure development.
These controls need technical evidence. Configuration screenshots, scan reports, backup restore tests and log reviews are what auditors sample. Vulnerability management (8.8) and security testing (8.29) are where independent testing earns its place; we explain how in does ISO 27001 require penetration testing.
Show all 34 technological controls
- 8.1 User endpoint devices
- 8.2 Privileged access rights
- 8.3 Information access restriction
- 8.4 Access to source code
- 8.5 Secure authentication
- 8.6 Capacity management
- 8.7 Protection against malware
- 8.8 Management of technical vulnerabilities
- 8.9 Configuration management New in 2022
- 8.10 Information deletion New in 2022
- 8.11 Data masking New in 2022
- 8.12 Data leakage prevention New in 2022
- 8.13 Information backup
- 8.14 Redundancy of information processing facilities
- 8.15 Logging
- 8.16 Monitoring activities New in 2022
- 8.17 Clock synchronisation
- 8.18 Use of privileged utility programs
- 8.19 Installation of software on operational systems
- 8.20 Networks security
- 8.21 Security of network services
- 8.22 Segregation of networks
- 8.23 Web filtering New in 2022
- 8.24 Use of cryptography
- 8.25 Secure development life cycle
- 8.26 Application security requirements
- 8.27 Secure system architecture and engineering principles
- 8.28 Secure coding New in 2022
- 8.29 Security testing in development and acceptance
- 8.30 Outsourced development
- 8.31 Separation of development, test and production environments
- 8.32 Change management
- 8.33 Test information
- 8.34 Protection of information systems during audit testing
The 11 New Controls in the 2022 Edition
Eleven controls were added to reflect how organisations and threats have changed since 2013. If you certified against the old edition, these are the ones that needed most new work during transition.
| Control | What it means in practice |
|---|---|
| 5.7 Threat intelligence | Collect and analyse information about threats relevant to you and use it to inform your defences. Our cyber threat intelligence service and Threat Watch help here. |
| 5.23 Cloud services | Define how you acquire, use, manage and exit cloud services securely, including shared responsibility |
| 5.30 ICT readiness for business continuity | Plan, test and maintain ICT so it can recover in line with business continuity objectives |
| 7.4 Physical security monitoring | Monitor premises for unauthorised physical access, for example with alarms or CCTV |
| 8.9 Configuration management | Define, document and monitor secure configurations for hardware, software, services and networks |
| 8.10 Information deletion | Delete information when it is no longer needed, from systems, devices and services |
| 8.11 Data masking | Mask sensitive data, such as personal data, in line with access policy and legal needs |
| 8.12 Data leakage prevention | Apply measures to detect and prevent unauthorised disclosure of sensitive information. See our data loss prevention service. |
| 8.16 Monitoring activities | Monitor networks, systems and applications for anomalous behaviour and act on it. Managed detection and response provides this around the clock. |
| 8.23 Web filtering | Manage access to external websites to reduce exposure to malicious content |
| 8.28 Secure coding | Apply secure coding principles to software development. Our DevSecOps team can help. |
Control Attributes
ISO/IEC 27002:2022 gives every control a set of attributes, which let you view the same controls through different lenses. There are five attribute types:
- Control type: preventive, detective or corrective
- Information security properties: confidentiality, integrity and availability
- Cyber security concepts: identify, protect, detect, respond and recover
- Operational capabilities: such as asset management, identity and access management or threat and vulnerability management
- Security domains: governance and ecosystem, protection, defence and resilience
Attributes are optional, but they are useful. The cyber security concepts line up with the NIST Cybersecurity Framework, which makes it easier to map ISO 27001 to other frameworks and to explain your control set to a board in familiar terms.
How to Choose Which Controls Apply
Control selection should follow your risk assessment, not precede it. The process looks like this:
1. Assess risk
- Identify assets and threats
- Rate likelihood and impact
- Decide which risks to treat
2. Select controls
- Choose controls to treat each risk
- Compare against Annex A
- Add legal and contractual needs
3. Record in the SoA
- All 93 controls listed
- Applicable or not, with reasons
- Implementation status
Most organisations find that the large majority of the 93 controls apply to them. Typical exclusions include secure development controls for organisations that do no software development, or some physical controls for fully remote organisations. Each exclusion needs a justification an auditor will accept, linked to your risk assessment, legal obligations or contracts.
You can also add controls that are not in Annex A. If a risk calls for a control the annex does not list, include it. Annex A is a minimum reference, not a ceiling.
Common Annex A Mistakes
- Treating Annex A as the standard. Clauses 4 to 10 are mandatory and are where many audit findings arise.
- Ticking "implemented" without evidence. Auditors sample. A control marked as implemented with no records is a finding.
- Weak exclusion reasons. "Not relevant" is not a justification. Explain why, with reference to your risks.
- One policy per control. Ninety three policies help nobody. Group related controls into a sensible set of documents.
- Forgetting suppliers and cloud. Many controls are partly delivered by providers. Show how you check them.
How Cybergen Can Help
We help organisations select, implement and evidence Annex A controls without drowning in paperwork. Through our ISO 27001 certification service we run the risk assessment, build a defensible Statement of Applicability, and deliver the technical controls auditors test most, from vulnerability management and CREST penetration testing to 24/7 monitoring. If you are wondering what that will cost or how long it will take, read our guides to ISO 27001 certification costs and ISO 27001 timelines.
Ready to see where you stand against all 93 controls? Book a free ISO 27001 gap analysis call.
Control names follow ISO/IEC 27001:2022 Annex A, summarised for readability. Always refer to your own licensed copy of the standard.
Frequently Asked Questions
How many controls are in ISO 27001 Annex A?
ISO/IEC 27001:2022 Annex A contains 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. The previous 2013 edition had 114 controls in 14 domains.
Do we need to implement all 93 Annex A controls?
No. You must consider every control and record in your Statement of Applicability whether it applies and why. Controls can be excluded when your risks, legal obligations and contracts do not require them, as long as you justify the decision.
What are the 11 new controls in ISO 27001:2022?
Threat intelligence (5.7), information security for use of cloud services (5.23), ICT readiness for business continuity (5.30), physical security monitoring (7.4), configuration management (8.9), information deletion (8.10), data masking (8.11), data leakage prevention (8.12), monitoring activities (8.16), web filtering (8.23) and secure coding (8.28).
What is the difference between Annex A and ISO 27002?
Annex A in ISO 27001 lists the controls with a short description of each. ISO/IEC 27002 is a separate guidance standard that explains the purpose of each control and how to implement it, and assigns attributes to each one.
Can we add controls that are not in Annex A?
Yes. If your risk assessment identifies a need for a control that Annex A does not include, you should add it. Annex A is a reference to make sure nothing important is missed, not a complete list.
Which Annex A controls do auditors check most?
Auditors sample across the Statement of Applicability, but access control, awareness training, supplier security, incident management, vulnerability management, backups and logging are commonly tested because they generate clear, checkable evidence.
Sources
CREST-certified consultants with over 100 years of combined experience in threat intelligence, penetration testing, MDR and compliance.
