Resources
ISO 27001:2022 Annex A controls: the complete list
Implementing ISO 27001 means putting all 93 Annex A controls into practice. This toolkit gives you a plain-language guide and a ready-to-use Control Pack for every one, published one control a day.
81 of 93 controls published
A new control publishes every day. Want to know the moment a control goes live? Reach out and we'll notify you.
A.5 · Organizational controls
37 of 37 live- A.5.1Policies for Information Security
- A.5.2Information Security Roles and Responsibilities
- A.5.3Segregation of Duties
- A.5.4Management Responsibilities
- A.5.5Contact with Authorities
- A.5.6Contact with Special Interest Groups
- A.5.7Threat Intelligence
- A.5.8Information Security in Project Management
- A.5.9Inventory of Information and Other Assets
- A.5.10Acceptable Use of Information
- A.5.11Return of Assets
- A.5.12Classification of Information
- A.5.13Labeling of Information
- A.5.14Information Transfer
- A.5.15Access Control
- A.5.16Identity Management
- A.5.17Authentication Information
- A.5.18Access Rights
- A.5.19Information Security in Supplier Relationships
- A.5.20Addressing Information Security Within Supplier Agreements
- A.5.21Managing Information Security in the ICT Supply Chain
- A.5.22Monitoring, Review and Change Management of Supplier Services
- A.5.23Information Security for Use of Cloud Services
- A.5.24Information Security Incident Management Planning and Preparation
- A.5.25Assessment and Decision on Information Security Events
- A.5.26Response to Information Security Incidents
- A.5.27Learning from Information Security Incidents
- A.5.28Collection of Evidence
- A.5.29Information Security during Disruption
- A.5.30ICT Readiness for Business Continuity
- A.5.31Legal, Statutory, Regulatory and Contractual Requirements
- A.5.32Intellectual Property Rights
- A.5.33Protection of Records
- A.5.34Privacy and Protection of PII
- A.5.35Independent Review of Information Security
- A.5.36Compliance with Policies, Rules and Standards for Information Security
- A.5.37Documented Operating Procedures
A.6 · People controls
8 of 8 live- A.6.1Screening
- A.6.2Terms and Conditions of Employment
- A.6.3Information Security Awareness, Education and Training
- A.6.4Disciplinary Process
- A.6.5Responsibilities After Termination or Change of Employment
- A.6.6Confidentiality or Non-Disclosure Agreements
- A.6.7Remote Working
- A.6.8Information Security Event Reporting
A.7 · Physical controls
14 of 14 live- A.7.1Physical Security Perimeters
- A.7.2Physical Entry
- A.7.3Securing Offices, Rooms and Facilities
- A.7.4Physical Security Monitoring
- A.7.5Protecting Against Physical and Environmental Threats
- A.7.6Working in Secure Areas
- A.7.7Clear Desk and Clear Screen
- A.7.8Equipment Siting and Protection
- A.7.9Security of Assets Off-Premises
- A.7.10Storage Media
- A.7.11Supporting Utilities
- A.7.12Cabling Security
- A.7.13Equipment Maintenance
- A.7.14Secure Disposal or Re-use of Equipment
A.8 · Technological controls
22 of 34 live- A.8.1User Endpoint Devices
- A.8.2Privileged Access Rights
- A.8.3Information Access Restriction
- A.8.4Access to Source Code
- A.8.5Secure Authentication
- A.8.6Capacity Management
- A.8.7Protection Against Malware
- A.8.8Management of Technical Vulnerabilities
- A.8.9Configuration Management
- A.8.10Information Deletion
- A.8.11Data Masking
- A.8.12Prevention of Data Leakage
- A.8.13Information Backup
- A.8.14Redundancy of Information Processing Facilities
- A.8.15Logging
- A.8.16Monitoring Activities
- A.8.17Synchronization of Clocks
- A.8.18Use of Privileged Utility Programs
- A.8.19Installation of Software on Operational Systems
- A.8.20Network Security
- A.8.21Security of Network Services
- A.8.22Segregation of Networks
- A.8.23Web Filtering20 Sept 2026
- A.8.24Use of Cryptography21 Sept 2026
- A.8.25Secure Development Life Cycle22 Sept 2026
- A.8.26Application Security Requirements23 Sept 2026
- A.8.27Secure System Architecture and Engineering Principles24 Sept 2026
- A.8.28Secure Coding25 Sept 2026
- A.8.29Security Testing in Development and Acceptance26 Sept 2026
- A.8.30Outsourced Development27 Sept 2026
- A.8.31Separation of Development, Test and Production Environments28 Sept 2026
- A.8.32Change Management29 Sept 2026
- A.8.33Test Information30 Sept 2026
- A.8.34Protection of Information Systems during Audit Testing1 Oct 2026
How we can help
Working toward ISO 27001?
If certification or a customer's security questionnaire is what brought you here, tell us where you are. We'll give you an honest read on the work and the timeline, with no obligation.