ISO 27001 Annex A: 93 Controls in Four Themes
Annex A of ISO/IEC 27001 contains 93 controls in four themes: A.5 organizational (37), A.6 people (8), A.7 physical (14) and A.8 technological (34). Eleven are new in the 2022 revision. The annex is normative, and every control must be considered — but implementing all 93 is not required and never was.
Annex A of ISO/IEC 27001 contains 93 controls in four themes: A.5 organizational (37), A.6 people (8), A.7 physical (14) and A.8 technological (34). Eleven are new in the 2022 revision. The annex is normative, and every control must be considered — but implementing all 93 is not required and never was.
What ISO 27001 Annex A is for
Annex A is normative, and the distinction that matters to an auditor is between implementing and considering. Nothing requires an organisation to implement all 93. Clause 6.1.3 c) requires the controls determined by the risk treatment to be compared against Annex A so that no necessary control is missed, and 6.1.3 d) requires any Annex A control excluded to be justified. So the auditable questions are whether every control was considered, whether the exclusions hold up, and whether what was selected operates.
So the direction of travel is: risk assessment, then risk treatment determines the controls, then Annex A as the completeness cross-check. The standard says in terms that its list is not exhaustive and that necessary controls may come from any source — a control the organisation designed itself, or took from another framework, belongs in the Statement of Applicability alongside the Annex A ones.
The restructure is the headline change. The previous edition carried 114 controls in 14 domains; this one carries 93 in four themes. Every one of the 114 maps forward and none was deleted — most of the reduction comes from merging controls that overlapped, with some renamed. The mapping tables in the guidance standard set it out control by control, and published summaries of the exact split vary. An organisation moving between editions remaps its controls and updates its Statement of Applicability.
Control titles below are as they appear in the annex. The control text is not reproduced — the standard is a copyright document, and the implementation guidance for each control sits in ISO/IEC 27002, which is where an organisation looks for how.
The eleven new controls in ISO 27001:2022 Annex A
These carry the most exam attention, because they are the visible difference between editions and because each one exists for a reason worth knowing.
| Control | Title | Theme |
|---|---|---|
| A.5.7 | Threat intelligence | Organizational |
| A.5.23 | Information security for use of cloud services | Organizational |
| A.5.30 | ICT readiness for business continuity | Organizational |
| A.7.4 | Physical security monitoring | Physical |
| A.8.9 | Configuration management | Technological |
| A.8.10 | Information deletion | Technological |
| A.8.11 | Data masking | Technological |
| A.8.12 | Data leakage prevention | Technological |
| A.8.16 | Monitoring activities | Technological |
| A.8.23 | Web filtering | Technological |
| A.8.28 | Secure coding | Technological |
Read as a group they describe what changed in the decade between editions: cloud services became the default rather than the exception (A.5.23), threat intelligence became a practice rather than a product (A.5.7), and a cluster of data-handling controls appeared for information that has to be kept usable while being restricted — deletion, masking, leakage prevention (A.8.10 to A.8.12).
What that means for an auditor. An organisation whose Statement of Applicability marks several of the eleven as excluded, with thin justifications, has usually mapped an older set of controls across without revisiting its risk assessment. That pattern is worth spotting: the exclusions are the symptom, and the unrevised risk assessment is the finding.
Looking for an approved provider?3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP 6039853.
The five ISO 27001 Annex A control attributes, and where they live
Get this one right, because a lot of published material does not. The five control attributes are new in the 2022 revision, but they live in ISO/IEC 27002, not in Annex A of ISO/IEC 27001. Annex A gives a reference number, a title and a control statement, and nothing more. Open it looking for attribute tables and you will not find them.
The five, with their values: control type (preventive, detective, corrective); information security properties (confidentiality, integrity, availability); cybersecurity concepts (identify, protect, detect, respond, recover); operational capabilities, a longer list covering things like governance, asset management, identity and access management, and application security; and security domains (governance and ecosystem, protection, defence, resilience). They exist so controls can be filtered and viewed different ways.
The one an auditor uses most is information security properties, because asking “which of confidentiality, integrity and availability does this control protect, and which risk does it treat?” is the fastest way to test whether a selection was reasoned or copied. The CIA triad page takes that further.
A.5 — Organizational controls
Thirty-seven controls, and the largest theme by some distance. These are the controls about how the organisation arranges itself: policies, roles, information handling, access, suppliers, incidents, continuity and compliance.
| Control | A.5 — Organizational controls (37) |
|---|---|
| A.5.1 | Policies for information security |
| A.5.2 | Information security roles and responsibilities |
| A.5.3 | Segregation of duties |
| A.5.4 | Management responsibilities |
| A.5.5 | Contact with authorities |
| A.5.6 | Contact with special interest groups |
| A.5.7 | Threat intelligence ★ new |
| A.5.8 | Information security in project management |
| A.5.9 | Inventory of information and other associated assets |
| A.5.10 | Acceptable use of information and other associated assets |
| A.5.11 | Return of assets |
| A.5.12 | Classification of information |
| A.5.13 | Labelling of information |
| A.5.14 | Information transfer |
| A.5.15 | Access control |
| A.5.16 | Identity management |
| A.5.17 | Authentication information |
| A.5.18 | Access rights |
| A.5.19 | Information security in supplier relationships |
| A.5.20 | Addressing information security within supplier agreements |
| A.5.21 | Managing information security in the ICT supply chain |
| A.5.22 | Monitoring, review and change management of supplier services |
| A.5.23 | Information security for use of cloud services ★ new |
| A.5.24 | Information security incident management planning and preparation |
| A.5.25 | Assessment and decision on information security events |
| A.5.26 | Response to information security incidents |
| A.5.27 | Learning from information security incidents |
| A.5.28 | Collection of evidence |
| A.5.29 | Information security during disruption |
| A.5.30 | ICT readiness for business continuity ★ new |
| A.5.31 | Legal, statutory, regulatory and contractual requirements |
| A.5.32 | Intellectual property rights |
| A.5.33 | Protection of records |
| A.5.34 | Privacy and protection of personally identifiable information |
| A.5.35 | Independent review of information security |
| A.5.36 | Compliance with policies, rules and standards for information security |
| A.5.37 | Documented operating procedures |
Where an auditor spends time here. The supplier cluster (A.5.19 to A.5.22, plus A.5.23 for cloud) is where scope, contracts and reality most often disagree. The incident cluster (A.5.24 to A.5.28) is testable against a real incident, which is more revealing than any procedure. And A.5.36, compliance with the organisation’s own policies, is the control that catches an ISMS whose documents nobody follows.
A.6 — People controls
Eight controls, covering the employment lifecycle from screening to what happens after someone leaves.
| Control | A.6 — People controls (8) |
|---|---|
| A.6.1 | Screening |
| A.6.2 | Terms and conditions of employment |
| A.6.3 | Information security awareness, education and training |
| A.6.4 | Disciplinary process |
| A.6.5 | Responsibilities after termination or change of employment |
| A.6.6 | Confidentiality or non-disclosure agreements |
| A.6.7 | Remote working |
| A.6.8 | Information security event reporting |
Where an auditor spends time here. A.6.5, responsibilities after termination or change of employment, is the one that produces findings, because leavers and internal movers are where access removal fails. A.6.3 covers awareness, education and training, so an attendance record is relevant evidence here — unlike at Clause 7.3, which is about awareness alone and is better tested by asking someone at a desk.
Preparing for the PR373 exam?Full-length mock exams and exam application support are included.
A.7 — Physical controls
Fourteen controls. This is the theme most often under-audited by auditors from an IT background, and the theme where a candidate who believes ISO/IEC 27001 is an IT standard loses marks.
| Control | A.7 — Physical controls (14) |
|---|---|
| A.7.1 | Physical security perimeters |
| A.7.2 | Physical entry |
| A.7.3 | Securing offices, rooms and facilities |
| A.7.4 | Physical security monitoring ★ new |
| A.7.5 | Protecting against physical and environmental threats |
| A.7.6 | Working in secure areas |
| A.7.7 | Clear desk and clear screen |
| A.7.8 | Equipment siting and protection |
| A.7.9 | Security of assets off-premises |
| A.7.10 | Storage media |
| A.7.11 | Supporting utilities |
| A.7.12 | Cabling security |
| A.7.13 | Equipment maintenance |
| A.7.14 | Secure disposal or re-use of equipment |
Where an auditor spends time here. A.7.7, clear desk and clear screen, is testable by walking through an office. A.7.10 storage media and A.7.14 secure disposal or re-use are where confidentiality leaks quietly. A.7.9, security of assets off-premises, has grown teeth as home working normalised.
A.8 — Technological controls
Thirty-four controls, and the theme most people picture when they think of the standard at all.
| Control | A.8 — Technological controls (34) |
|---|---|
| A.8.1 | User endpoint devices |
| A.8.2 | Privileged access rights |
| A.8.3 | Information access restriction |
| A.8.4 | Access to source code |
| A.8.5 | Secure authentication |
| A.8.6 | Capacity management |
| A.8.7 | Protection against malware |
| A.8.8 | Management of technical vulnerabilities |
| A.8.9 | Configuration management ★ new |
| A.8.10 | Information deletion ★ new |
| A.8.11 | Data masking ★ new |
| A.8.12 | Data leakage prevention ★ new |
| A.8.13 | Information backup |
| A.8.14 | Redundancy of information processing facilities |
| A.8.15 | Logging |
| A.8.16 | Monitoring activities ★ new |
| A.8.17 | Clock synchronization |
| A.8.18 | Use of privileged utility programs |
| A.8.19 | Installation of software on operational systems |
| A.8.20 | Networks security |
| A.8.21 | Security of network services |
| A.8.22 | Segregation of networks |
| A.8.23 | Web filtering ★ new |
| A.8.24 | Use of cryptography |
| A.8.25 | Secure development life cycle |
| A.8.26 | Application security requirements |
| A.8.27 | Secure system architecture and engineering principles |
| A.8.28 | Secure coding ★ new |
| A.8.29 | Security testing in development and acceptance |
| A.8.30 | Outsourced development |
| A.8.31 | Separation of development, test and production environments |
| A.8.32 | Change management |
| A.8.33 | Test information |
| A.8.34 | Protection of information systems during audit testing |
Where an auditor spends time here. A.8.15 logging and A.8.16 monitoring activities go together, and organisations often log and never analyse or monitor — logging everything and reviewing nothing is a control bought and not operated. A.8.8, management of technical vulnerabilities, is testable against the patch record for a system you pick rather than one they offer. And A.8.13 information backup is the control most often marked implemented on the strength of backups running rather than of anything being restored.
Want structured preparation?One year of LMS access and HD recordings come with the course.
Why ISO 27001 Annex A has four themes, and not the old fourteen
The previous structure grouped controls by subject area — access control, cryptography, physical security, supplier relationships and so on — which produced fourteen domains of very uneven size and a good deal of duplication between them.
The four themes group by what kind of thing the control is instead. Is it an arrangement the organisation makes (organizational), something about the people who work there (people), something about the physical world (physical), or something implemented in technology (technological)?
That question is easier to answer from a scenario than “which of fourteen subject areas is this?”, which is the practical reason the restructure helps a candidate. It also explains the sizes: A.5 is large because most of what an ISMS does is arrangements, and A.6 is small because the employment lifecycle has few distinct stages.
Learning ISO 27001 Annex A without memorising it
Nobody remembers 93 control titles from cold. What matters far more is being able to place a situation in the right region of the annex. Three habits do that work.
Learn the themes, not the numbers. If you can say “this is an organisational matter, so A.5” or “this is about the building, so A.7”, you are already most of the way to the right reference. The four themes are broad and the boundaries are intuitive.
Learn the clusters inside A.5 and A.8. The two big themes are not flat lists. A.5 runs in blocks: policies and roles, information handling and classification, access, suppliers, incidents, continuity, compliance. A.8 runs: access and endpoints, protective technology, data handling, resilience, logging and monitoring, networks, cryptography, development. Knowing which block a control lives in narrows a search to five or six candidates.
Learn the eleven new ones properly. They are the shortest list with the highest return, and a scenario built around cloud services, data leakage or threat intelligence is almost certainly testing one of them.
ISO 27001 Annex A controls that get confused
A handful of pairs sit close enough together to produce wrong references, and the exam knows it.
- A.5.15 access control is the policy-level requirement. A.5.18 access rights is provisioning, review and removal. A leaver whose account survived is usually A.5.18.
- A.5.16 identity management is about identities existing and being managed. A.5.17 authentication information is about credentials. A.8.5 secure authentication is about how authentication is performed — multi-factor lives here.
- A.8.15 logging covers producing, storing, protecting and analysing the logs. A.8.16 monitoring activities is monitoring networks, systems and applications for anomalous behaviour and acting on it. Organisations often log and never analyse or monitor.
- A.5.29 information security during disruption is the general continuity requirement. A.5.30 ICT readiness for business continuity is specifically about technology being ready to meet the continuity objectives.
- A.8.32 change management is the technology-change control. Clause 6.3 planning of changes is about changes to the ISMS itself. Different objects, and citing the wrong one is a wrong answer.
What to do with Annex A in an ISO 27001 audit
Not read it in order. The annex is a checklist for the organisation to verify against, not a route through an audit.
The productive sequence is the reverse of the list. Take a real risk from the risk assessment, follow it to the controls the treatment selected, find those controls in the Statement of Applicability, and then ask to see them operating. Annex A is what you use to ask the other question — given these risks, is anything necessary missing?
Most of what an annex-related finding turns on is visible from the Statement of Applicability before you speak to anyone — a justification that does not survive contact with the business, a status the operational evidence contradicts, a control the risk assessment needs and the Statement excludes. The Statement of Applicability page works through how to read one line by line.
ISO 27001 Annex A: how many controls in each theme?
Pick a theme to see how many controls it holds and which are new in 2022.
How to use it: Choose the option that fits you from the list. The answer appears below.
37 + 8 + 14 + 34 = 93 controls; 3 + 0 + 1 + 7 = 11 new. Figures from the tables in this article.
Frequently asked questions about ISO 27001 Annex A
How many controls are in ISO 27001 Annex A?
93, in four themes: organizational (37), people (8), physical (14) and technological (34).
What are the 11 new controls in ISO 27001:2022?
A.5.7 threat intelligence, A.5.23 information security for use of cloud services, A.5.30 ICT readiness for business continuity, A.7.4 physical security monitoring, A.8.9 configuration management, A.8.10 information deletion, A.8.11 data masking, A.8.12 data leakage prevention, A.8.16 monitoring activities, A.8.23 web filtering and A.8.28 secure coding.
Do all 93 ISO 27001 Annex A controls have to be implemented?
No. All must be considered. Controls are determined by the risk treatment, then compared against Annex A so that none necessary is missed, and any Annex A control excluded must be justified in the Statement of Applicability.
What happened to the 114 controls from the previous ISO 27001 edition?
They were restructured into 93 across four themes, mostly by merging controls that overlapped. Every one maps forward and none was deleted. Assume the current numbering in an examination.
Where do I find guidance on how to implement an ISO 27001 Annex A control?
ISO/IEC 27002. It gives implementation guidance for each Annex A control and is not a requirements standard, so it is not audit criteria in itself.
Where to go next: more ISO 27001 Lead Auditor exam preparation
- ISO/IEC 27001 clauses 4 to 10, clause by clause
- How plan-do-check-act maps onto the clauses
- The ISO/IEC 27000 family: which standard does what
3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is PR373 . Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.
Booking a PR373 course? See the schedule, trainers and what’s included.
Leave a reply