SecurityGlobal

ISO 27001:2022 (Security Controls)

Make security controls visible through completed work

Connect Annex A safeguards to the policies, tasks, assets and evidence that show how they operate.

What this page covers
Annex A of ISO/IEC 27001:2022, the reference list of information security controls, with guidance in ISO/IEC 27002:2022
Issued by
ISO and IEC, through their joint technical committee on information security
Editions
ISO/IEC 27002:2022 published February 2022. ISO/IEC 27001:2022, with the same 93 controls in Annex A, published 25 October 2022.
Nature
Voluntary international standard. Annex A is used within an ISO 27001 management system; ISO 27002 itself is guidance and is not certified against.
Structure
93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological
Key document
The Statement of Applicability, which records which controls apply, why, and the justification for any exclusion

Overview

What the Annex A controls are

ISO/IEC 27001 has two parts that work together. Clauses 4 to 10 set out how to run an information security management system, and are covered on the ISO 27001:2022 (Requirements) page. Annex A, covered here, is a reference list of 93 information security controls. Each control has a number and a short control statement. The detailed guidance on what each control is for and how to implement it sits in a companion standard, ISO/IEC 27002:2022, which uses the same numbering and titles.

Annex A is not a checklist that every organisation must implement in full. Under Clause 6.1.3 of ISO 27001, the organisation first decides how to treat its risks, then compares the controls it has chosen with Annex A to check that nothing necessary has been missed. The result is the Statement of Applicability: a document listing each control, whether it is included, why, whether it is implemented, and the justification for any exclusion. Organisations can also add controls from other sources.

The 2022 edition reorganised the controls from 114 in 14 groups to 93 in four themes: organisational, people, physical and technological. Many earlier controls were merged, and 11 were new, including threat intelligence, information security for use of cloud services, ICT readiness for business continuity, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.

ISO/IEC 27002:2022 also gives each control a set of attributes, such as control type and cybersecurity concept, using hashtag values. These are optional tags that help organisations filter and view the controls from different angles, for example to map them to another framework. Annex A of ISO 27001 does not include the attributes.

Who it applies to

The Annex A controls are relevant to:

  • Any organisation implementing or certified to ISO/IEC 27001:2022, which must produce a Statement of Applicability against Annex A
  • Organisations using ISO/IEC 27002 as a control baseline without seeking certification
  • Technology, SaaS and IT services providers answering customer security questionnaires
  • Banks, NBFCs, insurers and their vendors, where regulators and customers expect controls aligned to a recognised standard
  • MSSPs, vCISOs and audit firms that assess clients against a common control set

Which controls apply is decided by your own risk assessment and treatment. A certification auditor checks that the decisions are justified and that the included controls operate.

Structure

All 93 controls, by theme

The controls are numbered as in ISO/IEC 27002:2022, which is why Annex A starts at 5.1. Titles are the official control titles; the descriptions are plain summaries, not the control text.

Organisational 5.1 to 5.8

Policies, roles and governance

5.1 Policies for information security
An information security policy and topic-specific policies, approved by management, communicated and reviewed.
5.2 Information security roles and responsibilities
Security roles and responsibilities defined and allocated to suit the organisation.
5.3 Segregation of duties
Conflicting duties and areas of responsibility kept separate.
5.4 Management responsibilities
Management requires all personnel to apply security in line with policies and procedures.
5.5 Contact with authorities
Contact maintained with relevant authorities, such as regulators and law enforcement.
5.6 Contact with special interest groups
Contact maintained with security forums and professional associations.
5.7 Threat intelligence
New in 2022. Information about threats collected and analysed to produce threat intelligence.
5.8 Information security in project management
Security built into project management, whatever the type of project.
Organisational 5.9 to 5.18

Assets, information handling and access

5.9 Inventory of information and other associated assets
An inventory of information and associated assets, with owners.
5.10 Acceptable use of information and other associated assets
Rules and procedures for acceptable use and handling.
5.11 Return of assets
Assets returned when employment, a contract or an agreement ends or changes.
5.12 Classification of information
Information classified according to security needs, based on confidentiality, integrity, availability and interested party requirements.
5.13 Labelling of information
Procedures to label information in line with the classification scheme.
5.14 Information transfer
Rules, procedures or agreements for transferring information, internally and externally, by all types of transfer.
5.15 Access control
Rules for physical and logical access, based on business and security requirements.
5.16 Identity management
The full life cycle of identities managed.
5.17 Authentication information
Allocation and management of authentication information, such as passwords, controlled, with guidance to users.
5.18 Access rights
Access rights provisioned, reviewed, modified and removed in line with policy and rules.
Organisational 5.19 to 5.23

Suppliers and cloud services

5.19 Information security in supplier relationships
Processes to manage the risks of using suppliers’ products and services.
5.20 Addressing information security within supplier agreements
Security requirements agreed with each supplier, according to the type of relationship.
5.21 Managing information security in the ICT supply chain
Processes to manage risks in the ICT products and services supply chain.
5.22 Monitoring, review and change management of supplier services
Supplier security practices and service delivery monitored, reviewed, evaluated and changes managed.
5.23 Information security for use of cloud services
New in 2022. Processes to acquire, use, manage and exit cloud services in line with security requirements.
Organisational 5.24 to 5.30

Incidents and continuity

5.24 Information security incident management planning and preparation
Incident management processes, roles and responsibilities defined, established and communicated.
5.25 Assessment and decision on information security events
Security events assessed to decide whether they are incidents.
5.26 Response to information security incidents
Incidents responded to in line with documented procedures.
5.27 Learning from information security incidents
Knowledge from incidents used to strengthen and improve controls.
5.28 Collection of evidence
Procedures to identify, collect, acquire and preserve evidence related to security events.
5.29 Information security during disruption
Security maintained at an appropriate level during disruption.
5.30 ICT readiness for business continuity
New in 2022. ICT readiness planned, implemented, maintained and tested against business continuity objectives.
Organisational 5.31 to 5.37

Legal requirements, compliance and procedures

5.31 Legal, statutory, regulatory and contractual requirements
Relevant requirements identified, documented and kept up to date.
5.32 Intellectual property rights
Procedures to protect intellectual property rights.
5.33 Protection of records
Records protected from loss, destruction, falsification, unauthorised access and unauthorised release.
5.34 Privacy and protection of PII
Privacy and protection of personally identifiable information met in line with applicable laws, regulations and contracts.
5.35 Independent review of information security
The approach to information security, including people, processes and technologies, reviewed independently at planned intervals or on significant change.
5.36 Compliance with policies, rules and standards for information security
Compliance with the organisation’s own security policies, topic-specific policies, rules and standards regularly reviewed.
5.37 Documented operating procedures
Operating procedures for information processing facilities documented and made available to those who need them.
People 6.1 to 6.8

People controls

6.1 Screening
Background verification of candidates before joining and on an ongoing basis, proportionate to risk and in line with law.
6.2 Terms and conditions of employment
Employment agreements state personnel’s and the organisation’s security responsibilities.
6.3 Information security awareness, education and training
Appropriate awareness, education and training, with regular updates on policies and procedures.
6.4 Disciplinary process
A formalised and communicated disciplinary process for policy violations.
6.5 Responsibilities after termination or change of employment
Security duties that remain valid after leaving or changing role defined, enforced and communicated.
6.6 Confidentiality or non-disclosure agreements
Confidentiality agreements reflecting the organisation’s needs, signed, reviewed and documented.
6.7 Remote working
Security measures for personnel working remotely.
6.8 Information security event reporting
A way for personnel to report observed or suspected security events promptly through appropriate channels.
Physical 7.1 to 7.14

Physical controls

7.1 Physical security perimeters
Perimeters defined and used to protect areas containing information and associated assets.
7.2 Physical entry
Secure areas protected by appropriate entry controls and access points.
7.3 Securing offices, rooms and facilities
Physical security designed and implemented for offices, rooms and facilities.
7.4 Physical security monitoring
New in 2022. Premises continuously monitored for unauthorised physical access.
7.5 Protecting against physical and environmental threats
Protection against natural disasters, attacks and accidents designed and implemented.
7.6 Working in secure areas
Security measures for working in secure areas.
7.7 Clear desk and clear screen
Clear desk rules for papers and removable media, and clear screen rules for facilities.
7.8 Equipment siting and protection
Equipment sited securely and protected.
7.9 Security of assets off-premises
Assets outside the organisation’s premises protected.
7.10 Storage media
Storage media managed through acquisition, use, transport and disposal, in line with the classification scheme.
7.11 Supporting utilities
Facilities protected from power failures and other disruptions caused by failures in supporting utilities.
7.12 Cabling security
Power, data and supporting cables protected from interception, interference or damage.
7.13 Equipment maintenance
Equipment maintained correctly to keep information available, intact and confidential.
7.14 Secure disposal or re-use of equipment
Sensitive data and licensed software removed or securely overwritten before disposal or re-use.
Technological 8.1 to 8.17

Endpoints, access, protection and operations

8.1 User endpoint devices
Information stored on, processed by or accessible through user endpoint devices protected.
8.2 Privileged access rights
Allocation and use of privileged access rights restricted and managed.
8.3 Information access restriction
Access to information and associated assets restricted in line with the access control policy.
8.4 Access to source code
Read and write access to source code, development tools and software libraries managed.
8.5 Secure authentication
Secure authentication technologies and procedures, based on access restrictions and the access control policy.
8.6 Capacity management
Use of resources monitored and adjusted in line with current and expected capacity needs.
8.7 Protection against malware
Protection against malware, supported by user awareness.
8.8 Management of technical vulnerabilities
Information about technical vulnerabilities obtained, exposure evaluated and appropriate measures taken.
8.9 Configuration management
New in 2022. Configurations, including security configurations, of hardware, software, services and networks established, documented, monitored and reviewed.
8.10 Information deletion
New in 2022. Information deleted when no longer required.
8.11 Data masking
New in 2022. Data masking used in line with access control policy, business requirements and applicable law.
8.12 Data leakage prevention
New in 2022. Measures applied to systems, networks and devices that process, store or transmit sensitive information.
8.13 Information backup
Backup copies of information, software and systems maintained and regularly tested in line with a backup policy.
8.14 Redundancy of information processing facilities
Enough redundancy in information processing facilities to meet availability requirements.
8.15 Logging
Logs that record activities, exceptions, faults and other relevant events produced, stored, protected and analysed.
8.16 Monitoring activities
New in 2022. Networks, systems and applications monitored for anomalous behaviour, with action taken to evaluate potential incidents.
8.17 Clock synchronization
Clocks of information processing systems synchronised to approved time sources.
Technological 8.18 to 8.34

Systems, networks, cryptography and development

8.18 Use of privileged utility programs
Utility programs that can override system and application controls restricted and tightly controlled.
8.19 Installation of software on operational systems
Procedures to manage software installation on operational systems securely.
8.20 Networks security
Networks and network devices secured, managed and controlled to protect information in systems and applications.
8.21 Security of network services
Security mechanisms, service levels and requirements of network services identified, implemented and monitored.
8.22 Segregation of networks
Groups of information services, users and information systems segregated in the organisation’s networks.
8.23 Web filtering
New in 2022. Access to external websites managed to reduce exposure to malicious content.
8.24 Use of cryptography
Rules for the effective use of cryptography, including cryptographic key management.
8.25 Secure development life cycle
Rules for the secure development of software and systems.
8.26 Application security requirements
Security requirements identified, specified and approved when developing or acquiring applications.
8.27 Secure system architecture and engineering principles
Principles for engineering secure systems established, documented, maintained and applied.
8.28 Secure coding
New in 2022. Secure coding principles applied to software development.
8.29 Security testing in development and acceptance
Security testing processes defined and implemented in the development life cycle.
8.30 Outsourced development
Outsourced system development directed, monitored and reviewed.
8.31 Separation of development, test and production environments
Development, testing and production environments separated and secured.
8.32 Change management
Changes to information processing facilities and systems subject to change management procedures.
8.33 Test information
Test information appropriately selected, protected and managed.
8.34 Protection of information systems during audit testing
Audit tests and other assurance activities on operational systems planned and agreed between the tester and management.
ISO/IEC 27002

Control attributes

ISO/IEC 27002:2022 tags each control with values for five attribute types. They are optional ways to sort and filter the controls; they are not requirements and do not appear in Annex A of ISO 27001.

Control type
Preventive, Detective or Corrective: when and how the control changes the risk.
Information security properties
Confidentiality, Integrity and Availability: which properties the control helps preserve.
Cybersecurity concepts
Identify, Protect, Detect, Respond and Recover: where the control sits in the cycle of handling cyber risk.
Operational capabilities
Governance, Asset management, Information protection, Human resource security, Physical security, System and network security, Application security, Secure configuration, Identity and access management, Threat and vulnerability management, Continuity, Supplier relationships security, Legal and compliance, Information security event management and Information security assurance.
Security domains
Governance and Ecosystem, Protection, Defence and Resilience.
Clause 6.1.3

The Statement of Applicability

The Statement of Applicability is where the Annex A controls meet the organisation’s risk decisions. ISO 27001 requires it to contain:

Necessary controls
The controls the organisation has determined are necessary to treat its risks, from Annex A or other sources.
Justification for inclusion
Why each necessary control is included, usually by reference to the risks, legal or contractual requirements it addresses.
Implementation status
Whether each necessary control is implemented or not.
Justification for exclusion
For any Annex A control that is excluded, the reason it is not needed.

Implementation roadmap

How to implement it, step by step

A typical route from the risk assessment to controls that operate and can be shown to an auditor. It runs inside the wider ISMS described on the ISO 27001:2022 (Requirements) page.

  1. 1

    Start from the risk assessment

    Controls follow risks, not the other way round. Make sure the risk assessment under Clause 6.1.2 is complete for the ISMS scope, with risk owners agreed.

    OutputsRisk assessmentRisk owners
  2. 2

    Select controls to treat the risks

    For each risk that needs treatment, choose the controls that reduce it to an acceptable level. Use ISO/IEC 27002 guidance, and add controls from other frameworks where they fit better.

    OutputsRisk treatment plan
  3. 3

    Compare with Annex A and write the Statement of Applicability

    Go through all 93 Annex A controls. Record which apply and why, their implementation status, and a justification for each exclusion. Keep the Statement consistent with the risk treatment plan.

    OutputsStatement of Applicability
  4. 4

    Assign owners and write topic-specific policies

    Give each control an owner. Write the topic-specific policies the controls rely on, such as access control, backup, cryptography and supplier security, under the overall information security policy.

    OutputsControl ownersTopic-specific policies
  5. 5

    Implement and build in evidence

    Put each control into operation so that it produces records as it runs: access reviews, backup tests, vulnerability scans, training completion and supplier reviews.

    OutputsOperating controlsEvidence trail
  6. 6

    Use the attributes to map and report

    Optionally, use the ISO 27002 attributes to view the controls by type, property or capability, and to map them to other frameworks you must meet.

    OutputsControl mapping
  7. 7

    Test, audit and improve

    Check that controls work through monitoring, internal audit and independent review under 5.35. Raise corrective actions and update the Statement of Applicability when risks, scope or controls change.

    OutputsInternal audit resultsUpdated Statement of Applicability

Audit and evidence guide

What auditors look for, and the evidence to keep

In an ISO 27001 certification audit, the auditor uses the Statement of Applicability as the map. They test whether the included controls are designed and operating, and whether exclusions are justified.

What reviewers look for

  • A Statement of Applicability that covers all 93 Annex A controls
  • Consistency between the Statement of Applicability, the risk assessment and the risk treatment plan
  • Exclusions with a real justification, not a blanket “not applicable”
  • Control owners who can explain how their controls work
  • Records showing controls operated over time, not only that policies exist
  • Access rights reviewed and removed on time (5.15 to 5.18, 8.2)
  • Supplier and cloud service security managed through the relationship (5.19 to 5.23)
  • Incident handling records and lessons learned (5.24 to 5.28)
  • Logging, monitoring, vulnerability and configuration management in practice (8.8, 8.9, 8.15, 8.16)
  • Backup and restore tests, and ICT continuity tests (8.13, 5.30)

Key timelines

Certificate validity, with surveillance audits between3 years
Statement of Applicability reviewOn change to risks or scope
Policies for information security (5.1)At planned intervals
Independent review of information security (5.35)Planned intervals or change
Backup testing (8.13)Regularly
Access rights reviews (5.18)As your policy defines

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Control selection

  • Statement of Applicability
  • Risk treatment plan
  • Topic-specific policies

Organisational controls

  • Asset inventory with owners
  • Classification scheme
  • Supplier agreements and reviews
  • Incident register
  • Legal and regulatory register

People controls

  • Screening records
  • Signed confidentiality agreements
  • Training completion
  • Leaver records

Physical controls

  • Visitor and entry logs
  • CCTV or monitoring records
  • Equipment disposal certificates
  • Maintenance logs

Technological controls

  • Access and privileged access reviews
  • Vulnerability scans and patch records
  • Backup and restore tests
  • Log and monitoring records
  • Change records

Development

  • Secure development rules
  • Code review and security test results
  • Environment separation evidence

Areas that often need attention

  • A Statement of Applicability that marks controls as implemented with no evidence behind them
  • Exclusions justified only by “not applicable”
  • Statement of Applicability out of step with the latest risk assessment
  • New 2022 controls, such as threat intelligence, configuration management and data leakage prevention, treated as paperwork
  • Supplier and cloud controls handled only at contract signature
  • Access reviews that are scheduled but not done
  • Backups that are never test-restored

How Netra helps

Where each part of the work lives in Netra

Netra loads the 93 Annex A controls as tasks and links each one to the policies, assets and evidence behind it. Work done for one control also counts towards other frameworks wherever the same control applies.

Each control owned and operating

Task Engine

Controls arrive as tasks with owners and due dates. Recurring tasks for reviews, tests and checks keep operating evidence current.

Status for every Annex A control

Compliance Centre

Status is derived from completed tasks and evidence, never typed in, so the Statement of Applicability can be checked against the work.

Topic-specific policies

Policy Hub

A policy library generated at onboarding, with a score that moves as the work behind each policy is completed.

Controls that follow risks

Risk Manager

A risk register with inherent and residual heatmaps. Risks come down as the linked control tasks are completed.

Asset inventory and the systems a control touches

Asset Management

Assets linked to tasks, so teams know where each control applies.

Supplier and cloud service controls

Third-Party Risk

Find vendors from what Accounts and Purchase pay, assess them through a vendor portal and record each decision with a rating.

Internal audit and certification audits

Audit Centre

Run audits end to end with findings and corrective actions, using evidence held in a tamper-evident vault.

Finding gaps in evidence

Netra AI

Works from the organisation’s own records to suggest missing evidence and draft SOPs. It never changes a control’s status on its own.

Netra organises control work and evidence. It does not by itself establish conformity with ISO/IEC 27001, and it is not a certification body. Certification is assessed and issued by an independent certification body.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Security

ISO 27001:2022 (Requirements)

Build an ISMS your team can run every day

Security

SOC 2

Prepare SOC 2 evidence as part of everyday work

Security

CIS v8.1

Give your security safeguards a clear operational home

See ISO 27001:2022 (Security Controls) in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.