Resources
ISO 27001:2022 Annex A controls: the complete list
ISO 27001 does not make you implement all 93 Annex A controls. You choose controls to treat the risks your own assessment finds, then check your choices against Annex A and record each decision in your Statement of Applicability. This toolkit gives you a plain-language guide and a ready-to-use Control Pack for every Annex A control, published one control a day.
93 of 93 controls published
A.5 · Organizational controls
37 of 37 live- A.5.1Policies for Information Security
- A.5.2Information Security Roles and Responsibilities
- A.5.3Segregation of Duties
- A.5.4Management Responsibilities
- A.5.5Contact with Authorities
- A.5.6Contact with Special Interest Groups
- A.5.7Threat Intelligence
- A.5.8Information Security in Project Management
- A.5.9Inventory of Information and Other Associated Assets
- A.5.10Acceptable Use of Information and Other Associated Assets
- A.5.11Return of Assets
- A.5.12Classification of Information
- A.5.13Labelling of Information
- A.5.14Information Transfer
- A.5.15Access Control
- A.5.16Identity Management
- A.5.17Authentication Information
- A.5.18Access Rights
- A.5.19Information Security in Supplier Relationships
- A.5.20Addressing Information Security Within Supplier Agreements
- A.5.21Managing Information Security in the ICT Supply Chain
- A.5.22Monitoring, Review and Change Management of Supplier Services
- A.5.23Information Security for Use of Cloud Services
- A.5.24Information Security Incident Management Planning and Preparation
- A.5.25Assessment and Decision on Information Security Events
- A.5.26Response to Information Security Incidents
- A.5.27Learning from Information Security Incidents
- A.5.28Collection of Evidence
- A.5.29Information Security during Disruption
- A.5.30ICT Readiness for Business Continuity
- A.5.31Legal, Statutory, Regulatory and Contractual Requirements
- A.5.32Intellectual Property Rights
- A.5.33Protection of Records
- A.5.34Privacy and Protection of PII
- A.5.35Independent Review of Information Security
- A.5.36Compliance with Policies, Rules and Standards for Information Security
- A.5.37Documented Operating Procedures
A.6 · People controls
8 of 8 live- A.6.1Screening
- A.6.2Terms and Conditions of Employment
- A.6.3Information Security Awareness, Education and Training
- A.6.4Disciplinary Process
- A.6.5Responsibilities After Termination or Change of Employment
- A.6.6Confidentiality or Non-Disclosure Agreements
- A.6.7Remote Working
- A.6.8Information Security Event Reporting
A.7 · Physical controls
14 of 14 live- A.7.1Physical Security Perimeters
- A.7.2Physical Entry
- A.7.3Securing Offices, Rooms and Facilities
- A.7.4Physical Security Monitoring
- A.7.5Protecting Against Physical and Environmental Threats
- A.7.6Working in Secure Areas
- A.7.7Clear Desk and Clear Screen
- A.7.8Equipment Siting and Protection
- A.7.9Security of Assets Off-Premises
- A.7.10Storage Media
- A.7.11Supporting Utilities
- A.7.12Cabling Security
- A.7.13Equipment Maintenance
- A.7.14Secure Disposal or Re-use of Equipment
A.8 · Technological controls
34 of 34 live- A.8.1User Endpoint Devices
- A.8.2Privileged Access Rights
- A.8.3Information Access Restriction
- A.8.4Access to Source Code
- A.8.5Secure Authentication
- A.8.6Capacity Management
- A.8.7Protection Against Malware
- A.8.8Management of Technical Vulnerabilities
- A.8.9Configuration Management
- A.8.10Information Deletion
- A.8.11Data Masking
- A.8.12Data Leakage Prevention
- A.8.13Information Backup
- A.8.14Redundancy of Information Processing Facilities
- A.8.15Logging
- A.8.16Monitoring Activities
- A.8.17Clock Synchronization
- A.8.18Use of Privileged Utility Programs
- A.8.19Installation of Software on Operational Systems
- A.8.20Networks Security
- A.8.21Security of Network Services
- A.8.22Segregation of Networks
- A.8.23Web Filtering
- A.8.24Use of Cryptography
- A.8.25Secure Development Life Cycle
- A.8.26Application Security Requirements
- A.8.27Secure System Architecture and Engineering Principles
- A.8.28Secure Coding
- A.8.29Security Testing in Development and Acceptance
- A.8.30Outsourced Development
- A.8.31Separation of Development, Test and Production Environments
- A.8.32Change Management
- A.8.33Test Information
- A.8.34Protection of Information Systems during Audit Testing
How we can help
Working toward ISO 27001?
If certification or a customer's security questionnaire is what brought you here, tell us where you are. We'll give you an honest read on the work and the timeline, with no obligation.
What happens next
Tell us the trigger
A questionnaire, an audit date or an investor ask. The short form or a call both work.
A practitioner replies
A senior practitioner, not a bot, within four business hours.
You get a scoped next step
An honest view of what the work involves. No pressure, no theatre.