Annex A of ISO/IEC 27001:2022 lists 93 information security controls in four themes: organizational, people, physical and technological. An organisation certified to ISO 27001 decides which of them apply, records that in a Statement of Applicability, and shows it operates the ones it has chosen.
Free account needed to download. You come straight back to the file.
Who it is for. Any organisation that wants an information security management system certified or assessed against ISO 27001, including software companies, service providers, and suppliers whose customers ask for it.
What this list covers. ISO/IEC 27001:2022 Annex A (93 controls in four themes): 93 controls. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it asks for |
|---|---|---|
| A.5.1 | Policies for information security | Write an information security policy, have management approve it, publish it and review it on a schedule. |
| A.5.2 | Information security roles and responsibilities | Name who is responsible for which security tasks, so nothing depends on someone assuming it is theirs. |
| A.5.3 | Segregation of duties | Split conflicting duties between different people, or add oversight where that is not possible. |
| A.5.4 | Management responsibilities | Managers make sure their teams follow the security policies and procedures. |
| A.5.5 | Contact with authorities | Know which authorities to contact about incidents or legal matters, and keep their details current. |
| A.5.6 | Contact with special interest groups | Stay in touch with security forums and professional groups to hear about threats and good practice. |
| A.5.7 | Threat intelligence | Collect and analyse information about threats so it can inform decisions and defences. |
| A.5.8 | Information security in project management | Build security requirements and risk checks into every project, whatever its size. |
| A.5.9 | Inventory of information and other associated assets | Keep an inventory of information and the assets that hold it, each with a named owner. |
| A.5.10 | Acceptable use of information and other associated assets | Set and communicate rules for how information and assets may be used. |
| A.5.11 | Return of assets | Make sure people hand back assets when they leave or change roles. |
| A.5.12 | Classification of information | Sort information by how sensitive it is, so protection can match. |
| A.5.13 | Labelling of information | Label information in a consistent way that tells people how to handle it. |
| A.5.14 | Information transfer | Protect information when it moves, whether by network, email, post or hand. |
| A.5.15 | Access control | Grant access on a business need and a documented rule, not by default. |
| A.5.16 | Identity management | Manage the full life of each identity: create, change, review and remove. |
| A.5.17 | Authentication information | Control how passwords and other secrets are issued, handled and kept. |
| A.5.18 | Access rights | Give, change and withdraw access rights through a controlled process, and review them. |
| A.5.19 | Information security in supplier relationships | Set and apply security requirements for suppliers who touch your information or systems. |
| A.5.20 | Addressing information security within supplier agreements | Put the security terms you need into the agreement with each supplier. |
| A.5.21 | Managing information security in the ICT supply chain | Manage the security risks that come through the supply chain for IT products and services. |
| A.5.22 | Monitoring, review and change management of supplier services | Watch supplier performance against the agreed security terms and handle their changes. |
| A.5.23 | Information security for use of cloud services | Define how cloud services are chosen, used, monitored and exited, with security in mind. |
| A.5.24 | Information security incident management planning and preparation | Plan how incidents will be handled: roles, steps, tools and who decides. |
| A.5.25 | Assessment and decision on information security events | Assess each reported security event and decide whether it is an incident. |
| A.5.26 | Response to information security incidents | Respond to incidents using the documented procedure and record what was done. |
| A.5.27 | Learning from information security incidents | Use what incidents teach you to improve controls and procedures. |
| A.5.28 | Collection of evidence | Collect and keep evidence in a way that preserves its value for investigation. |
| A.5.29 | Information security during disruption | Keep security in place while the organisation is dealing with a disruption. |
| A.5.30 | ICT readiness for business continuity | Prepare IT so business continuity objectives can be met, and test that readiness. |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | Identify the laws, regulations and contract terms that apply, and meet them. |
| A.5.32 | Intellectual property rights | Respect software licences and other intellectual property rights. |
| A.5.33 | Protection of records | Protect records from loss, damage, falsification and unauthorised access. |
| A.5.34 | Privacy and protection of PII | Protect personal information as privacy law and your obligations require. |
| A.5.35 | Independent review of information security | Have the security programme reviewed by someone independent at planned intervals. |
| A.5.36 | Compliance with policies, rules and standards for information security | Check regularly that people and systems follow the policies and standards. |
| A.5.37 | Documented operating procedures | Document operating procedures and make them available to those who need them. |
| Ref | Control | What it asks for |
|---|---|---|
| A.6.1 | Screening | Check the background of candidates before hiring, in proportion to the role and the law. |
| A.6.2 | Terms and conditions of employment | State security responsibilities in employment terms and contracts. |
| A.6.3 | Information security awareness, education and training | Train people in security when they join and keep that awareness current. |
| A.6.4 | Disciplinary process | Have a formal, communicated process for dealing with security policy breaches. |
| A.6.5 | Responsibilities after termination or change of employment | Say which security duties continue after someone leaves or moves, and enforce them. |
| A.6.6 | Confidentiality or non-disclosure agreements | Use confidentiality agreements with staff and others who see sensitive information. |
| A.6.7 | Remote working | Protect information when people work from home or other remote locations. |
| A.6.8 | Information security event reporting | Give people an easy, clear way to report security events and weaknesses quickly. |
| Ref | Control | What it asks for |
|---|---|---|
| A.7.1 | Physical security perimeters | Define and protect the boundaries of areas that hold information and critical equipment. |
| A.7.2 | Physical entry | Control who enters secure areas, including visitors and deliveries. |
| A.7.3 | Securing offices, rooms and facilities | Secure offices, rooms and facilities so they do not reveal or expose sensitive activity. |
| A.7.4 | Physical security monitoring | Monitor premises for unauthorised physical access. |
| A.7.5 | Protecting against physical and environmental threats | Protect against fire, flood, power faults and other physical and environmental threats. |
| A.7.6 | Working in secure areas | Set and follow rules for working inside secure areas. |
| A.7.7 | Clear desk and clear screen | Keep desks and screens clear of sensitive information when unattended. |
| A.7.8 | Equipment siting and protection | Place and protect equipment to reduce environmental risk and unauthorised access. |
| A.7.9 | Security of assets off-premises | Protect assets that leave the premises, such as laptops and phones. |
| A.7.10 | Storage media | Manage storage media through its life, from acquisition to disposal. |
| A.7.11 | Supporting utilities | Protect facilities from power and other utility failures. |
| A.7.12 | Cabling security | Protect power and network cabling from interception, interference and damage. |
| A.7.13 | Equipment maintenance | Maintain equipment so it stays available and its integrity is preserved. |
| A.7.14 | Secure disposal or re-use of equipment | Check equipment for stored data and remove or destroy it before disposal or re-use. |
| Ref | Control | What it asks for |
|---|---|---|
| A.8.1 | User endpoint devices | Protect information on laptops, phones and other endpoints, including personal devices if allowed. |
| A.8.2 | Privileged access rights | Limit and control the allocation and use of privileged access. |
| A.8.3 | Information access restriction | Restrict access to information and systems in line with the access control policy. |
| A.8.4 | Access to source code | Control read and write access to source code and related development material. |
| A.8.5 | Secure authentication | Use secure sign-in methods appropriate to the sensitivity of what is being accessed. |
| A.8.6 | Capacity management | Monitor and plan the use of resources so capacity does not become a security problem. |
| A.8.7 | Protection against malware | Protect against malware with technical controls and user awareness. |
| A.8.8 | Management of technical vulnerabilities | Find technical vulnerabilities, assess your exposure and act on them in time. |
| A.8.9 | Configuration management | Set, record, review and monitor secure configurations for hardware, software and networks. |
| A.8.10 | Information deletion | Delete information when it is no longer needed, in line with retention rules. |
| A.8.11 | Data masking | Mask or pseudonymise sensitive data where its full form is not needed. |
| A.8.12 | Data leakage prevention | Apply measures that detect and prevent unauthorised disclosure of information. |
| A.8.13 | Information backup | Back up information, software and systems, and test that restores work. |
| A.8.14 | Redundancy of information processing facilities | Build in redundancy so critical services meet their availability requirements. |
| A.8.15 | Logging | Record, protect and analyse logs of activities, exceptions and events. |
| A.8.16 | Monitoring activities | Monitor networks, systems and applications for unusual behaviour and respond to it. |
| A.8.17 | Clock synchronization | Keep system clocks synchronised to an agreed time source. |
| A.8.18 | Use of privileged utility programs | Restrict and tightly control utility programs that can override system controls. |
| A.8.19 | Installation of software on operational systems | Control how software is installed on operational systems. |
| A.8.20 | Networks security | Secure and manage networks and the devices on them. |
| A.8.21 | Security of network services | Identify and agree security features and service levels for network services. |
| A.8.22 | Segregation of networks | Separate groups of users, services and systems on the network. |
| A.8.23 | Web filtering | Manage access to external websites to reduce exposure to malicious content. |
| A.8.24 | Use of cryptography | Define and apply rules for cryptography, including key management. |
| A.8.25 | Secure development life cycle | Set rules for developing software and systems securely and follow them. |
| A.8.26 | Application security requirements | Identify and approve security requirements when developing or buying applications. |
| A.8.27 | Secure system architecture and engineering principles | Apply secure engineering principles to the design of systems and applications. |
| A.8.28 | Secure coding | Use secure coding practice and check that it is applied. |
| A.8.29 | Security testing in development and acceptance | Define and carry out security testing during development and before acceptance. |
| A.8.30 | Outsourced development | Direct, monitor and review security for work outsourced to others. |
| A.8.31 | Separation of development, test and production environments | Keep development, test and production environments apart and protected. |
| A.8.32 | Change management | Put changes to systems and facilities through a controlled change process. |
| A.8.33 | Test information | Choose, protect and manage test data with care, and avoid live personal data. |
| A.8.34 | Protection of information systems during audit testing | Plan and agree audit tests so they do not disrupt operational systems. |
Annex A has 93 controls, down from 114 in the 2013 edition. They are grouped into four themes (organizational, people, physical and technological) instead of 14 domains.
No. You assess risk, select the controls you need, and record every Annex A control as applicable or not, with a reason, in a Statement of Applicability. You can add controls from elsewhere if your risks call for it.
No. The references and short headings identify each control; the sentence beside each is our own plain-English summary. Buy the standard for the authoritative wording.
A spreadsheet-ready CSV of the same list with blank columns for applicability, status, owner and evidence, so you can use it as the start of a Statement of Applicability.