Annex A — Controls
ISO 27001 Annex A contains 93 controls across four categories. Each control describes a security measure that organisations can implement to protect their information. Here you will find a practice-oriented explanation for each control, including BSI mapping, typical audit evidence and KPIs.
What is ISO 27002?
ISO 27001 tells you which controls you need. ISO 27002 tells you how to implement them. Annex A of ISO 27001 lists 93 controls as a reference — short one-liners defining what each control should achieve. The actual implementation guidance lives in ISO 27002:2022, the companion standard. There you will find a dedicated section for each control with purpose, guidance and supplementary information.
The 93 controls are organised into four themes: organisational (policies, processes, responsibilities), people (training, screening, employment terms), physical (buildings, equipment, environment) and technological (systems, networks, cryptography, development). This structure is new since the 2022 revision — the previous 2013 version had 114 controls in 14 groups.
How to select controls
Risk treatment determines which controls you need — Annex A is the checklist, not the obligation list. ISO 27001 Clause 6.1.3 requires you to compare the controls from Annex A with your risk treatment. The result is the Statement of Applicability (SoA): a table documenting for each of the 93 controls whether it applies, why (or why not), and how it is implemented.
In practice this works in three steps. First, identify risks to your information assets. Then decide for each risk how to treat it — avoid, transfer, accept, or reduce through controls. Finally, check against Annex A to ensure nothing was missed. Controls you do not need (e.g. A.8.28 Secure Coding if you do not develop software) are marked as not applicable — with justification.
The most common mistake: marking all 93 controls as applicable without linking them to your risk landscape. This produces an SoA that cannot be defended in an audit. Better: fewer controls, well justified and demonstrably implemented.
A.5 — Organisational Controls 37
37 controls covering policies, roles, access, suppliers, incidents, compliance and business continuity.
A.5.1 — Policies for Information Security and Privacy 
A.5.2 — Information Security Roles and Responsibilities 
A.5.3 — Segregation of Duties 
A.5.4 — Management Responsibilities 
A.5.5 — Contact with Authorities 
A.5.6 — Contact with Special Interest Groups 
A.5.7 — Threat Intelligence 
A.5.8 — Information Security in Project Management 
A.5.9 — Inventory of Information and Other Associated Assets 
A.5.10 — Acceptable Use of Information and Other Associated Assets 
A.5.11 — Return of Assets 
A.5.12 — Classification of Information 
A.5.13 — Labelling of Information 
A.5.14 — Information Transfer 
A.5.15 — Access Control 
A.5.16 — Identity Management 
A.5.17 — Authentication Information 
A.5.18 — Access Rights 
A.5.19 — Information Security in Supplier Relationships 
A.5.20 — Addressing Information Security Within Supplier Agreements 
A.5.21 — Managing Information Security in the ICT Supply Chain 
A.5.22 — Monitoring, Review and Change Management of Supplier Services 
A.5.23 — Information Security for Use of Cloud Services 
A.5.24 — Incident Management Planning and Preparation 
A.5.25 — Assessment and Decision on Information Security Events 
A.5.26 — Response to Information Security Incidents 
A.5.27 — Learning from Information Security Incidents 
A.5.28 — Collection of Evidence 
A.5.29 — Information Security During Disruption 
A.5.30 — ICT Readiness for Business Continuity 
A.5.31 — Legal, Statutory, Regulatory and Contractual Requirements 
A.5.32 — Intellectual Property Rights 
A.5.33 — Protection of Records 
A.5.34 — Privacy and Protection of PII 
A.5.35 — Independent Review of Information Security 
A.5.36 — Compliance with Policies, Rules and Standards 
A.5.37 — Documented Operating Procedures A.6 — People Controls 8
8 controls covering screening, employment terms, awareness training, disciplinary processes and remote working.
A.6.1 — Screening 
A.6.2 — Terms and Conditions of Employment 
A.6.3 — Information Security Awareness, Education and Training 
A.6.4 — Disciplinary Process 
A.6.5 — Responsibilities After Termination or Change of Employment 
A.6.6 — Confidentiality or Non-Disclosure Agreements 
A.6.7 — Remote Working 
A.6.8 — Information Security Event Reporting A.7 — Physical Controls 14
14 controls covering physical access, monitoring, environmental protection, equipment and secure disposal.
A.7.1 — Physical Security Perimeters 
A.7.2 — Physical Entry 
A.7.3 — Securing Offices, Rooms and Facilities 
A.7.4 — Physical Security Monitoring 
A.7.5 — Protecting Against Physical and Environmental Threats 
A.7.6 — Working in Secure Areas 
A.7.7 — Clear Desk and Clear Screen 
A.7.8 — Equipment Siting and Protection 
A.7.9 — Security of Assets Off-Premises 
A.7.10 — Storage Media 
A.7.11 — Supporting Utilities 
A.7.12 — Cabling Security 
A.7.13 — Equipment Maintenance 
A.7.14 — Secure Disposal or Re-Use of Equipment A.8 — Technological Controls 34
34 controls covering endpoints, networks, cryptography, logging, vulnerabilities, development and change management.
A.8.1 — User Endpoint Devices 
A.8.2 — Privileged Access Rights 
A.8.3 — Information Access Restriction 
A.8.4 — Access to Source Code 
A.8.5 — Secure Authentication 
A.8.6 — Capacity Management 
A.8.7 — Protection Against Malware 
A.8.8 — Management of Technical Vulnerabilities 
A.8.9 — Configuration Management 
A.8.10 — Information Deletion 
A.8.11 — Data Masking 
A.8.12 — Data Leakage Prevention 
A.8.13 — Information Backup 
A.8.14 — Redundancy of Information Processing Facilities 
A.8.15 — Logging 
A.8.16 — Monitoring Activities 
A.8.17 — Clock Synchronization 
A.8.18 — Use of Privileged Utility Programs 
A.8.19 — Installation of Software on Operational Systems 
A.8.20 — Networks Security 
A.8.21 — Security of Network Services 
A.8.22 — Segregation of Networks 
A.8.23 — Web Filtering 
A.8.24 — Use of Cryptography 
A.8.25 — Secure Development Life Cycle 
A.8.26 — Application Security Requirements 
A.8.27 — Secure System Architecture and Engineering Principles 
A.8.28 — Secure Coding 
A.8.29 — Security Testing in Development and Acceptance 
A.8.30 — Outsourced Development 
A.8.31 — Separation of Development, Test and Production Environments 
A.8.32 — Change Management 
A.8.33 — Test Information 
A.8.34 — Protection of Information Systems During Audit Testing