Compliance › ISO 27001 › Annex A controls
ISO 27001 Annex A controlsISO 27001 Annex A controls: all 93 listed by theme, with what each one asks for
Annex A is the control list auditors test you against. This page lists all 93 controls of ISO/IEC 27001:2022 in plain English, flags the 11 that are new, and explains how to select controls and record them in the Statement of Applicability.
Free for buyers · provider-funded introductions · Updated October 2026
Annex A at a glance
Controls93 in four themes
OrganizationalA.5, 37 controls
PeopleA.6, 8 controls
PhysicalA.7, 14 controls
TechnologicalA.8, 34 controls
New in 202211 controls
Mandatory?Selected by risk. Exclusions need a reason
The short answer
What are the ISO 27001 Annex A controls?
Annex A of ISO/IEC 27001:2022 is a reference list of 93 information security controls in four themes: organizational (37), people (8), physical (14) and technological (34). You do not implement all of them by default. You select the controls your risks call for, compare your list with Annex A so nothing needed is missed, and record each decision, with reasons, in the Statement of Applicability.
- Annex A controls are chosen by risk. The mandatory part of the standard is clauses 4 to 10, covered in our requirements guide.
- Guidance on how to implement each control sits in ISO/IEC 27002:2022, a separate standard.
- The 2022 list replaced the 114 controls of 2013. Eleven controls are new.
The whole list
All 93 Annex A controls at a glance
Each box is one control, numbered within its theme. Amber boxes are the 11 new in 2022.
A.5 Organizational
A.5 Organizational controls (37)
Governance, assets, access, suppliers, incidents and compliance.
| Control | Title | What it asks for |
|---|---|---|
| A.5.1 | Policies for information security | Define, approve, publish and review a policy and topic-specific policies |
| A.5.2 | Information security roles and responsibilities | Define and allocate who is responsible for what |
| A.5.3 | Segregation of duties | Keep conflicting duties and areas of responsibility separate |
| A.5.4 | Management responsibilities | Management requires staff to apply security in line with policy |
| A.5.5 | Contact with authorities | Keep contact with relevant authorities |
| A.5.6 | Contact with special interest groups | Keep contact with security forums and professional bodies |
| A.5.7 | Threat intelligence (new) | Collect and analyse information on threats to produce intelligence |
| A.5.8 | Information security in project management | Build security into projects of any type |
| A.5.9 | Inventory of information and other associated assets | Keep an inventory of information and assets, with owners |
| A.5.10 | Acceptable use of information and other associated assets | Set and apply rules for acceptable use |
| A.5.11 | Return of assets | Return assets when employment or a contract changes or ends |
| A.5.12 | Classification of information | Classify information by its security needs |
| A.5.13 | Labelling of information | Label information according to the classification scheme |
| A.5.14 | Information transfer | Set rules for transferring information inside and outside the organisation |
| A.5.15 | Access control | Set rules for physical and logical access based on business and security needs |
| A.5.16 | Identity management | Manage identities through their whole life cycle |
| A.5.17 | Authentication information | Control how authentication information is allocated and managed |
| A.5.18 | Access rights | Provision, review, change and remove access rights |
| A.5.19 | Information security in supplier relationships | Manage the risks of using suppliers |
| A.5.20 | Addressing information security within supplier agreements | Agree security requirements with each supplier |
| A.5.21 | Managing information security in the ICT supply chain | Manage security risks in the ICT products and services supply chain |
| A.5.22 | Monitoring, review and change management of supplier services | Regularly monitor, review and manage changes to supplier services |
| A.5.23 | Information security for use of cloud services (new) | Acquire, use, manage and exit cloud services under your own rules |
| A.5.24 | Information security incident management planning and preparation | Plan roles, processes and responsibilities for incidents |
| A.5.25 | Assessment and decision on information security events | Assess events and decide whether each is an incident |
| A.5.26 | Response to information security incidents | Respond using documented procedures |
| A.5.27 | Learning from information security incidents | Use what incidents teach to strengthen controls |
| A.5.28 | Collection of evidence | Identify, collect and preserve evidence of security events |
| A.5.29 | Information security during disruption | Keep security at an appropriate level during disruption |
| A.5.30 | ICT readiness for business continuity (new) | Plan, implement and test ICT readiness against continuity objectives |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | Identify, document and keep up to date the requirements that apply |
| A.5.32 | Intellectual property rights | Protect intellectual property rights |
| A.5.33 | Protection of records | Protect records from loss, falsification and unauthorised access |
| A.5.34 | Privacy and protection of PII | Meet personal data requirements under law and contract |
| A.5.35 | Independent review of information security | Review your approach independently at planned intervals |
| A.5.36 | Compliance with policies, rules and standards | Regularly check compliance with your own policies and standards |
| A.5.37 | Documented operating procedures | Document operating procedures and make them available |
Control numbers and titles follow ISO/IEC 27001:2022 Annex A. The right-hand column is our plain-English paraphrase, not the standard text.
A.6 People
A.6 People controls (8)
What you do before, during and after someone works for you.
| Control | Title | What it asks for |
|---|---|---|
| A.6.1 | Screening | Check candidates before they join, in proportion to risk |
| A.6.2 | Terms and conditions of employment | State security responsibilities in contracts |
| A.6.3 | Information security awareness, education and training | Give staff awareness, education and training, and refresh it |
| A.6.4 | Disciplinary process | Have a formal process for security policy violations |
| A.6.5 | Responsibilities after termination or change of employment | Define duties that remain after someone leaves or changes role |
| A.6.6 | Confidentiality or non-disclosure agreements | Identify, review and sign confidentiality agreements |
| A.6.7 | Remote working | Apply security measures when people work remotely |
| A.6.8 | Information security event reporting | Give staff a way to report observed or suspected events promptly |
None of the people controls is new in 2022. Remote working (A.6.7) replaces the older teleworking control.
A.7 Physical
A.7 Physical controls (14)
Premises, equipment and media. Cloud-only companies still need to consider these.
| Control | Title | What it asks for |
|---|---|---|
| A.7.1 | Physical security perimeters | Define and use perimeters to protect areas holding information and assets |
| A.7.2 | Physical entry | Protect secure areas with entry controls and access points |
| A.7.3 | Securing offices, rooms and facilities | Design and apply physical security for them |
| A.7.4 | Physical security monitoring (new) | Continuously monitor premises for unauthorised physical access |
| A.7.5 | Protecting against physical and environmental threats | Protect against natural disasters and other physical threats |
| A.7.6 | Working in secure areas | Define and apply measures for working in secure areas |
| A.7.7 | Clear desk and clear screen | Set rules for papers, removable media and screens |
| A.7.8 | Equipment siting and protection | Site equipment securely and protect it |
| A.7.9 | Security of assets off-premises | Protect assets that are away from your premises |
| A.7.10 | Storage media | Manage storage media through its life cycle, by classification |
| A.7.11 | Supporting utilities | Protect equipment from power failures and similar disruption |
| A.7.12 | Cabling security | Protect power and telecommunications cabling |
| A.7.13 | Equipment maintenance | Maintain equipment so information stays available and intact |
| A.7.14 | Secure disposal or re-use of equipment | Verify data and licensed software are removed before disposal or re-use |
A fully remote or cloud-hosted company may exclude controls that do not apply, such as A.7.1 for an office it does not have. The exclusion still needs a recorded reason, and it must hold up when an auditor asks about home offices, laptops and your hosting provider.
A.8 Technological
A.8 Technological controls (34)
The hands-on technical controls, and the largest share of the new ones.
| Control | Title | What it asks for |
|---|---|---|
| A.8.1 | User endpoint devices | Protect information on, processed by or reachable from user devices |
| A.8.2 | Privileged access rights | Restrict and manage how privileged access is allocated and used |
| A.8.3 | Information access restriction | Restrict access in line with your access control rules |
| A.8.4 | Access to source code | Manage read and write access to source code, tools and libraries |
| A.8.5 | Secure authentication | Use secure authentication matched to access restrictions |
| A.8.6 | Capacity management | Monitor and adjust resource use to meet capacity needs |
| A.8.7 | Protection against malware | Implement malware protection, supported by user awareness |
| A.8.8 | Management of technical vulnerabilities | Find vulnerabilities, assess exposure and act on them |
| A.8.9 | Configuration management (new) | Establish, document, monitor and review configurations |
| A.8.10 | Information deletion (new) | Delete information when it is no longer required |
| A.8.11 | Data masking (new) | Mask data in line with access control rules and legal needs |
| A.8.12 | Data leakage prevention (new) | Apply leakage prevention where sensitive information is handled |
| A.8.13 | Information backup | Keep backup copies and test them regularly |
| A.8.14 | Redundancy of information processing facilities | Add enough redundancy to meet availability needs |
| A.8.15 | Logging | Produce, store, protect and analyse logs |
| A.8.16 | Monitoring activities (new) | Monitor networks, systems and applications for anomalous behaviour |
| A.8.17 | Clock synchronization | Synchronise system clocks to approved time sources |
| A.8.18 | Use of privileged utility programs | Restrict and tightly control utilities that can override controls |
| A.8.19 | Installation of software on operational systems | Manage software installation on operational systems securely |
| A.8.20 | Networks security | Secure, manage and control networks and network devices |
| A.8.21 | Security of network services | Define security mechanisms and service levels for network services |
| A.8.22 | Segregation of networks | Segregate groups of services, users and systems |
| A.8.23 | Web filtering (new) | Manage access to external websites to reduce exposure to malicious content |
| A.8.24 | Use of cryptography | Set and apply cryptography rules, including key management |
| A.8.25 | Secure development life cycle | Set and apply rules for secure development |
| A.8.26 | Application security requirements | Identify and approve security requirements for applications you build or buy |
| A.8.27 | Secure system architecture and engineering principles | Establish, document and apply secure engineering principles |
| A.8.28 | Secure coding (new) | Apply secure coding principles in software development |
| A.8.29 | Security testing in development and acceptance | Define and carry out security testing |
| A.8.30 | Outsourced development | Direct, monitor and review outsourced development |
| A.8.31 | Separation of development, test and production environments | Separate and secure these environments |
| A.8.32 | Change management | Put changes through change management procedures |
| A.8.33 | Test information | Select, protect and manage test information appropriately |
| A.8.34 | Protection of information systems during audit testing | Plan audit tests with management to limit disruption |
If you also need a report on these areas for US customers, see how they line up with the SOC 2 controls list. The two frameworks overlap in intent but not in structure or wording.
What changed
The 11 new controls in ISO 27001:2022
Most are technical. Several simply give names to things good teams already did.
| Control | Title | Why it matters in practice |
|---|---|---|
| A.5.7 | Threat intelligence | You need a way to learn about threats that apply to you and act on it |
| A.5.23 | Information security for use of cloud services | Cloud use needs rules from acquisition to exit |
| A.5.30 | ICT readiness for business continuity | Systems must be ready to meet continuity objectives, and tested |
| A.7.4 | Physical security monitoring | Premises need monitoring for unauthorised access |
| A.8.9 | Configuration management | Secure configurations are defined, tracked and reviewed |
| A.8.10 | Information deletion | Data is deleted when no longer needed |
| A.8.11 | Data masking | Sensitive data is masked where full values are not needed |
| A.8.12 | Data leakage prevention | Measures to stop sensitive data leaving where it should not |
| A.8.16 | Monitoring activities | Networks, systems and apps are watched for anomalies |
| A.8.23 | Web filtering | Access to malicious or risky sites is managed |
| A.8.28 | Secure coding | Secure coding principles are applied when building software |
Guides disagree on which controls are new. Some list ICT supply chain security (A.5.21) or tag more than 11, but the standard-level list is the 11 above. Control A.5.21 existed in a different form in 2013.
Per ISO’s summary of ISO/IEC 27002:2022, the move from 114 to 93 controls comprised 11 new, 24 merged and 58 updated.
Selecting controls
How to select Annex A controls and write the Statement of Applicability
The risk work decides the list. Annex A is how you check you have not missed anything.
| Control | Applicable? | Justification (example) | Status (example) |
|---|---|---|---|
| A.8.4 Access to source code | Yes | We build our product in-house | Implemented |
| A.7.1 Physical security perimeters | Partly | Small office only, no data centre | Implemented for the office |
| A.8.30 Outsourced development | No | All development is done in-house | Excluded, reason recorded |
| A.5.23 Cloud services | Yes | The product runs on a cloud provider | In progress |
The Statement of Applicability must show the controls you decided are necessary, why, whether they are implemented, and why any Annex A control is excluded. It is not a copy of the Annex A list. See how it fits the audit in the certification process guide.
ISO 27002
Annex A vs ISO 27002: controls and guidance
Annex A names the controls. A separate standard explains how to implement them.
| Document | What it gives you | Is it auditable? |
|---|---|---|
| ISO/IEC 27001:2022 Annex A | The list of 93 controls, with short titles and statements | Yes, through your Statement of Applicability |
| ISO/IEC 27002:2022 | Guidance on purpose, implementation and attributes for each control | No. It is guidance, not a requirement |
ISO 27002:2022 also tags each control with attributes so you can filter the list, such as by control type, security property or security domain.
| Attribute | Examples of values |
|---|---|
| Control type | Preventive, detective, corrective |
| Information security properties | Confidentiality, integrity, availability |
| Cybersecurity concepts | Identify, protect, detect, respond, recover |
| Operational capabilities | Such as governance, asset management, identity and access management |
| Security domains | Governance and ecosystem, protection, defence, resilience |
Use ISO 27002 to decide how to implement a control. Do not treat its guidance as extra audit requirements. Buy or read the standard for the full text.
Audit evidence
What auditors commonly ask to see, by theme
Auditors sample what your Statement of Applicability says you do.
| Theme | Evidence commonly asked for (examples) |
|---|---|
| Organizational | Approved policies, supplier agreements and reviews, incident tickets and post-incident reviews, access review records |
| People | Screening records, signed terms and confidentiality agreements, training completion, leaver checklists |
| Physical | Visitor and access records, equipment disposal records. For remote or cloud-only firms, hosting provider assurance and home-working rules |
| Technological | Access lists and reviews, vulnerability scan and patch records, backup restore tests, change tickets, log samples |
Examples only. Your certification body decides sampling and detail. For how the audits run, read the certification process guide.
Avoid these
Six Annex A mistakes that cause findings
- Copying a template Statement of Applicability: auditors read yours first, and generic reasons show quickly.
- Excluding controls without a reason: every exclusion needs a recorded justification.
- Treating Annex A as a to-do list: implementing all 93 regardless of risk wastes effort and adds evidence you must maintain.
- Ignoring the 11 new controls: threat intelligence, data deletion and monitoring are tested like any other.
- Never updating the Statement of Applicability: new systems and risks change the answer.
- Treating ISO 27002 guidance as requirements: the guidance explains how, it does not add audit criteria.
FAQ
ISO 27001 Annex A controls: common questions
How many controls are in ISO 27001 Annex A?
93 in ISO/IEC 27001:2022, in four themes: organizational (37), people (8), physical (14) and technological (34). The 2013 version had 114 controls in 14 domains.
Are all ISO 27001 Annex A controls mandatory?
No. You select the controls your risks call for, compare your list with Annex A so nothing needed is missed, and record every decision in the Statement of Applicability. Any Annex A control you exclude needs a recorded reason.
What is the Statement of Applicability?
A document required by clause 6.1.3 that lists the controls you decided are necessary, why they are included, whether they are implemented, and why any Annex A control is excluded. See the requirements guide.
What are the 11 new controls in ISO 27001:2022?
A.5.7 threat intelligence, A.5.23 information security for use of cloud services, A.5.30 ICT readiness for business continuity, A.7.4 physical security monitoring, A.8.9 configuration management, A.8.10 information deletion, A.8.11 data masking, A.8.12 data leakage prevention, A.8.16 monitoring activities, A.8.23 web filtering and A.8.28 secure coding.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 sets the requirements for an ISMS and is the standard you certify against. Its Annex A lists the controls. ISO 27002 is a separate standard giving guidance on implementing each control. It is not audited as a requirement.
Can I exclude Annex A controls?
Yes, if they do not apply to your scope and risks. You must record why in the Statement of Applicability, and the reason has to hold up under audit.
Can I add controls that are not in Annex A?
Yes. Annex A is a reference list, not a ceiling. If your risks need a control it does not contain, add it and record it.
Which Annex A controls should I implement first?
The standard does not rank controls. Your risk assessment decides which are necessary for your scope, and the Statement of Applicability records the result.
Do I need every applicable control in place before the audit?
Auditors test what your Statement of Applicability says. It must state honestly whether each control is implemented. Ask your certification body how it treats controls that are planned but not yet in place. See the certification process guide.
What changed in Annex A between 2013 and 2022?
The list was restructured from 114 controls in 14 domains to 93 controls in four themes. Eleven controls are new, and others were merged or reworded.
How do Annex A controls relate to SOC 2?
They overlap in intent, such as access control, change management and incident response, but not in structure or wording. See the SOC 2 controls list and the SOC 2 vs ISO 27001 comparison.
Who checks that I have implemented the controls?
An accredited certification body, during the Stage 2 audit and later surveillance audits. ISO itself does not audit or certify.
Start here
Know your controls? Now get matched with the right provider.
Requirement→Scope→Price→Matched provider
Tell Us What You NeedFree for buyers · provider-funded introductions · Reviewed October 2026 by the ZCyberSecurity compliance team