ISO 27001:2022 controls list
93 controls. Any organisation that wants an information security management system certified or assessed against ISO 27001, including software companies, service providers, and suppliers whose customers ask for it.
One list for each framework your customers and regulators ask about, in plain English. Read it here, then download it as a tracking sheet with a free account.
93 controls. Any organisation that wants an information security management system certified or assessed against ISO 27001, including software companies, service providers, and suppliers whose customers ask for it.
22 categories. Organisations of any size or sector that want a common language for managing and reporting cybersecurity risk.
63 requirements. Merchants, payment processors and service providers that handle card data, and any company whose systems could affect the security of that data.
51 criteria. Software and service companies that hold customer data and are asked by customers for independent assurance.
10 risk categories. Development teams, security testers and buyers of web applications.
27 obligations. Organisations in the EU, and organisations elsewhere, including Indian exporters and service providers, that offer goods or services to people in the EU or monitor their behaviour.
21 sections. Any organisation, in India or abroad, that decides why and how personal data of people in India is processed.
7 directions. Service providers, intermediaries, data centres, bodies corporate and government organisations in India, and the foreign providers that serve users in India.
16 sections. Every body corporate and intermediary operating in India, and anyone who accesses computer resources there.
A controls list is the start of a gap assessment. Mark which items apply to you, say who owns each one, note the evidence you would show an auditor, and the gaps become a work plan. The download has those columns ready.
The lists are summaries in our own words, built to help you plan. They do not replace the standards, laws and directions they refer to, and they are not legal advice. Talk to us if you would like help turning one into a programme.