Annex A.5 Organizational Controls: What an Auditor Tests
A.5 is the largest theme in Annex A, with 37 of the 93 controls, and the widest in subject matter: policy, roles, assets, classification, access, suppliers, cloud, incidents, continuity, legal and compliance. It is best audited not control by control but in groups, because the controls in a group share their evidence.
A.5 is the largest theme in Annex A, with 37 of the 93 controls, and the widest in subject matter: policy, roles, assets, classification, access, suppliers, cloud, incidents, continuity, legal and compliance. It is best audited not control by control but in groups, because the controls in a group share their evidence.
The organisations in the worked examples on this page are invented, and so are the examples. They show how a finding against a control is built and graded; they are not a list of the findings you should expect to encounter.
The organisations in the worked examples on this page are invented, and so are the examples themselves. They show how a finding against a control is built and graded.
Before any ISO 27001 Annex A.5 control: what makes it auditable
Annex A is a reference set, not a checklist. Controls are selected in the risk treatment process at Clause 6.1.3, and the selection is recorded in the Statement of Applicability. So the first question about any control on this page is not “is it in place?” but “did the organisation say it applies, and on what basis?” A control the Statement of Applicability marks not applicable, with a justification that holds, is not a finding. A control it marks applicable and implemented, with nothing operating behind it, is one.
And keep the two layers apart. A control that is not working is an Annex A finding; a Statement of Applicability that misstates whether it is working is a Clause 6.1.3 d) finding. One visit can produce both, and they are answered by different people.
One point candidates lose marks on. The five control attributes — control type, information security properties, cybersecurity concepts, operational capabilities and security domains — are in ISO/IEC 27002, not in Annex A of ISO/IEC 27001. Annex A gives the reference number, the title and a control statement. If an organisation has used the attributes to filter its selection, that is good practice you can note; it is not something the standard requires of it.
The seven groups inside ISO 27001 Annex A.5
Thirty-seven controls is too many to hold as a list. They fall into groups that share evidence, and once you see the groups the theme becomes navigable.
| Group | Controls | What holds the evidence |
|---|---|---|
| Governance and policy | 5.1 to 5.8 | The policy set, role descriptions, project gates, the threat intelligence arrangement |
| Assets and classification | 5.9 to 5.14 | The asset inventory, the classification scheme, labelling in practice, transfer arrangements |
| Access, at policy level | 5.15 to 5.18 | The access control rules, the identity lifecycle, how authentication information is issued and handled |
| Suppliers and cloud | 5.19 to 5.23 | The supplier register and what sits behind each entry — five separate requirements, one document |
| Incidents | 5.24 to 5.28 | The incident procedure and the roles behind it, the register, the arrangements for preserving evidence |
| Continuity | 5.29 to 5.30 | Arrangements for maintaining information security during disruption, and ICT readiness specifically |
| Legal and compliance | 5.31 to 5.37 | The legal register, licence records, records protection, privacy arrangements, independent review, compliance checking, operating procedures |
Auditing by group is not a shortcut. It is how the evidence presents itself: ask for the classification scheme and you are inside 5.12, 5.13 and 5.14 at once, with one person in front of you who can answer for all three.
Want structured preparation?One year of LMS access and HD recordings come with the course.
ISO 27001 Annex A.5 governance and policy controls: 5.1 to 5.8
A.5.1 asks for policies for information security — the overarching one and topic-specific ones — defined, approved, published, communicated and reviewed at planned intervals or on significant change. That last limb carries most of the testing. A policy set that has never been reviewed since it was written has not met the control, however good the policies are.
A.5.2 and A.5.4 cover roles and management responsibilities. Both are close relatives of Clause 5.3, and the difference is worth having straight before you write anything down: Clause 5.3 requires roles for the management system to be assigned and communicated; A.5.2 is the control that puts information security responsibilities on named people; A.5.4 requires management to require all personnel to apply information security in accordance with the established information security policy, topic-specific policies and procedures of the organisation.
A.5.3 is segregation of duties. The audit question is not whether a policy mentions it but whether any single person can complete a sensitive sequence unaided.
A.5.5 and A.5.6 ask for contact with relevant authorities, and with special interest groups or other specialist forums and professional associations. Both are commonly marked applicable and evidenced thinly, because they read as formalities rather than as arrangements.
A.5.7, threat intelligence, is one of the eleven controls the 2022 revision added. Information relating to information security threats is to be collected and analysed to produce threat intelligence.
A.5.8 puts information security into project management. The evidence is a real project: what security requirements were set for it, who set them, and what happened at the gates.
A worked ISO 27001 finding on Annex A.5.5
Thurlow Ceramics makes technical ceramics for the energy sector and holds a mature policy set, reviewed annually with approval records.
| Statement | Contact with relevant authorities has not been established or maintained. |
|---|---|
| Objective evidence | The Statement of Applicability, version 4, marks A.5.5 applicable and implemented, with the justification “required for incident escalation and regulatory notification”. The information security policy states that the information security manager maintains contact with the sector regulator and with the national cyber authority. No record of any contact, registration, named point of contact or correspondence was produced. The information security manager stated that no contact has been established and that the entry was carried over when the Statement of Applicability was drafted. The incident procedure identifies two circumstances requiring notification to an authority within a stated period; neither has arisen in the period audited. |
| Requirement | ISO/IEC 27001 Annex A.5.5 requires the organisation to establish and maintain contact with relevant authorities. |
| Grade | Minor — the control is unimplemented, but its subject is a single arrangement rather than a process the ISMS runs on, no notification circumstance has arisen in the period, and the incident procedure identifies the circumstances in which the contact would be needed; an incident that required the contact would move it. |
One discipline in writing any of these. Record what you were told as fact where it establishes how far the failure reaches; do not write your own diagnosis of why it happened. Causes are the organisation’s to establish under Clause 10.2, and supplying one hands the auditee something to argue about instead of something to answer. Here the information security manager’s account of how the entry reached the Statement of Applicability is recorded because it tells the reader where to look next — at every other line drafted the same way. The finding stops there and does not say the document was compiled carelessly.
Note what else is available on this evidence and is not raised here. The Statement of Applicability claims the control is implemented and it is not, which is a Clause 6.1.3 d) matter. Whether that is a second finding is a judgement: the Annex A finding stands on its own, and the Statement of Applicability finding is worth raising separately only if the same pattern shows up in other lines. One line carried over is an error; a pattern of them is a process failure, and it is the pattern you have to evidence.
ISO 27001 Annex A.5 assets and classification controls: 5.9 to 5.14
Six controls, usually audited together, working outward from the inventory.
5.9 — an inventory of information and other associated assets, with ownership identified.
5.10 — rules for the acceptable use of information and other associated assets, and procedures for handling them.
5.11 — return of assets on termination or change of employment. This is the leaver control that is not about accounts, and it is regularly the weakest link in an otherwise tidy offboarding process.
5.12 and 5.13 — classification according to the organisation’s information security needs, then a set of procedures for labelling in accordance with that scheme. The pair is the most productive place to start in this group. Ask for the scheme, then ask to see a document, a folder and a screen and read the labelling against it. A scheme with nothing labelled to it is a 5.13 finding; a scheme whose categories nobody can apply consistently is a 5.12 one.
5.14 — information transfer, covering rules, procedures and agreements for transfer by all types of transfer facility. Ask how a document classified at the top of the organisation’s own scheme reaches somebody outside, and follow the answer to whatever carries it. The gap between the classification scheme and the transfer arrangements is where this group usually fails.
Not sure about the course yet?One year of free retraining on the same exam version is included.
A worked ISO 27001 finding on Annex A.5.11
Bracewell Archives is a records storage and digitisation business with 260 staff and a documented offboarding process that is followed.
| Statement | The return of assets on termination or change of employment is not verified or recorded. |
|---|---|
| Objective evidence | The offboarding checklist requires the line manager to record the return of issued equipment. Twenty-two leavers and internal transfers from the period were sampled. For nine, the checklist records equipment as returned. For eleven, the equipment section is blank and the asset inventory continues to show the item assigned to the individual; four of those eleven concern people who left more than a year ago. For the remaining two, the checklist records the return of a laptop while the inventory shows a laptop and a mobile handset issued, and no disposition is recorded for the handset. The facilities manager confirmed that returned equipment is not reconciled against the inventory and that nothing prompts a follow-up when the section is left blank. |
| Requirement | ISO/IEC 27001 Annex A.5.11 requires personnel and other interested parties as appropriate to return all the organisation’s assets in their possession upon change or termination of their employment, contract or agreement. The organisation’s offboarding procedure, section 6, makes recording the return of issued equipment a required step and assigns it to the line manager. |
| Grade | Major — the failure affects more than half the sample and reaches back over a year, and nothing in the process detects or corrects it, so the control is not operating rather than operating imperfectly. The evidence does not establish that the equipment was never returned, and the finding does not say so; what it establishes is that the organisation cannot tell. |
What makes this a defensible major is not the arithmetic. It is that the evidence shows the omission goes uncorrected: the checklist has no follow-up step and the inventory is never reconciled. Eleven blanks in a process that later catches them would be a minor on exactly the same numbers.
And note what the statement does not claim. A blank field and a stale inventory prove that the return was not verified or recorded. They do not prove the equipment is missing, and a statement saying assets were not returned is defeated by the auditee producing eleven laptops from a cupboard. The inventory limb belongs to A.5.9 and would need its own requirement line if you wanted it; here it stays in the evidence, where it does the work of showing that nothing detects the gap.
ISO 27001 Annex A.5 access controls at policy level: 5.15 to 5.18
Four controls that set the rules the A.8 technical controls then enforce. 5.15 requires rules for physical and logical access to be established and implemented, based on business and information security requirements. 5.16 covers the full lifecycle of identities. 5.17 governs authentication information: its allocation and management, and what users are told about handling it. 5.18 covers access rights — provision, review, modification and removal, in accordance with the organisation’s topic-specific policy on access control.
A.5.17 is commonly overlooked, and weaknesses that get written up as technical failures often belong to it: how an initial credential is issued and delivered, what happens when one is reset, and whether authentication information is held in a form the organisation would be willing to describe. It is worth a question wherever the technical access controls look sound.
Looking for an approved provider?3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP 6039853.
ISO 27001 Annex A.5 supplier and cloud controls: 5.19 to 5.23
The supplier group runs 5.19 for the processes and requirements for managing the risks of supplier relationships, 5.20 for what goes into the agreement, 5.21 for the information and communication technology supply chain, 5.22 for the ongoing monitoring, review and change management of supplier services, and 5.23 for the use of cloud services. Five separate requirements, and evidence that answers one of them frequently answers none of the others.
ISO 27001 Annex A.5 incident controls: 5.24 to 5.28
The incident group runs 5.24 planning and preparation, including roles and responsibilities and the processes themselves, 5.25 assessment of information security events and the decision on whether each is an incident, 5.26 response in accordance with the documented procedures, 5.27 learning, and 5.28 the identification, collection, acquisition and preservation of evidence. A.5.28 is worth an auditor’s attention on its own, because it is about the organisation’s ability to preserve what it would need afterwards, and it is regularly marked applicable with no procedure behind it at all.
ISO 27001 Annex A.5 continuity controls: 5.29 to 5.30
Two controls that are regularly confused. A.5.29, information security during disruption. A.5.30, ICT readiness for business continuity, one of the eleven controls the 2022 revision added. Their titles are the whole of the distinction, and a finding has to name which of the two the evidence belongs to. Deciding that is a skill in its own right, and the practice set linked at the foot of this page works through the distinction on a specimen.
ISO 27001 Annex A.5 legal and compliance controls: 5.31 to 5.37
5.31 requires legal, statutory, regulatory and contractual requirements to be identified, documented and kept up to date. 5.32 covers intellectual property. 5.33 protects records against loss, destruction, falsification, unauthorised access and unauthorised release. 5.34 covers privacy and the protection of personally identifiable information.
And the three that close the theme. A.5.35 requires the organisation’s approach to managing information security and its implementation to be reviewed independently at planned intervals or when significant changes occur. A.5.36 requires compliance with the organisation’s own information security policy, topic-specific policies, rules and standards to be reviewed regularly. A.5.37 requires operating procedures for information processing facilities to be documented and made available to the personnel who need them.
A.5.37 is the one to test on this page’s own principle, because it is easy to evidence badly. A procedure held in a document library satisfies the documented half. Whether it is available to the personnel who need it is answered at the place the work happens, by whoever does it, and that is a different question with a different answer more often than an organisation expects.
Major or minor in ISO 27001 Annex A.5
Grade on evidence and reach, never on how serious the failure feels, and remember that related minors can add up to a major. What is particular to a theme this wide is that the controls differ enormously in how much of the ISMS depends on them.
Major territory: a control the ISMS depends on marked applicable and implemented with nothing whatever operating behind it; operating procedures that exist nowhere the work is done; a classification scheme the organisation relies on that has never been applied; an asset control failing across the population with nothing to correct it.
Minor territory: a policy set reviewed late in one cycle; labelling applied inconsistently in one area; one record type outside the protection the organisation’s own schedule specifies.
Escalation: several minors in different groups of A.5 that all trace back to the same absent activity — nobody checking — make a case under A.5.36 or in Clause 9, rather than five separate minors.
A last word on what this page is not. Thirty-seven controls is not thirty-seven agenda items. An audit that gives each of them a few minutes has tested none of them, and on a theme this wide the temptation is real. Choose a handful, chosen on risk and on what the Statement of Applicability claims, and follow each one all the way down.
ISO 27001 Annex A.5: where is the evidence for each group?
Pick a group of A.5 controls to see which controls it holds and what evidence to ask for.
How to use it: Choose the option that fits you from the list. The answer appears below.
From the table in this article. A.5 has 37 controls; the seven groups are a teaching convention, not the standard's own structure.
Frequently asked questions about ISO 27001 Annex A.5
How many controls are in ISO 27001 Annex A.5?
37, the largest of the four themes. A.6 has 8, A.7 has 14 and A.8 has 34, making 93 in total. Annex A of ISO/IEC 27001:2022 is normative, and the controls are selected on the basis of risk rather than adopted wholesale.
Which ISO 27001 Annex A.5 controls are new in the 2022 revision?
Three: A.5.7 threat intelligence, A.5.23 information security for use of cloud services, and A.5.30 ICT readiness for business continuity. They are three of the eleven new controls across the whole annex.
What is the difference between Annex A.5.1 and ISO 27001 Clause 5.2?
Clause 5.2 requires the overarching information security policy and states what it must contain. A.5.1 is the control covering the policy set as a whole, including topic-specific policies, and requires them to be reviewed at planned intervals or on significant change. They are separate requirements and can be separate findings.
Is an unimplemented ISO 27001 control automatically a major?
No. Grade on the evidence and its reach. A control that is absent and that the ISMS depends on is a major; a control that is absent, narrow in effect and not yet called upon can be a minor. What is marked is the reasoning, not the label.
Where does the Statement of Applicability fit in ISO 27001 Annex A?
It is required by Clause 6.1.3 d) and records the necessary controls, the justification for including each, whether each is implemented, and the justification for excluding any Annex A control. It is your entry point: audit what it claims rather than what you expect to find.
The other three ISO 27001 Annex A themes
the A.8 technological controls
The management system clauses behind these controls have deep dives of their own: the clause map for lead auditors sets out all of Clauses 4 to 10, and which record evidences which clause matches each requirement to the record that evidences it.
3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.
Booking a PR373 course? See the schedule, trainers and what’s included.
Leave a reply