ISO 27001 Annex A Controls Explained: All 93 Controls Grouped by Theme

ISO 27001:2022 Annex A contains 93 controls organized into four themes, a significant restructuring from the 2013 version which had 114 controls across 14 domains. These controls represent the reference set of information security measures that organizations select from based on their risk assessment results. Understanding the full landscape of Annex A controls is essential for building a comprehensive Statement of Applicability and implementing an effective Information Security Management System.

Annex A Structure: From 14 Domains to 4 Themes

• ISO 27001:2022 reorganized controls from 14 domains into 4 themes with 93 total controls
• Organizational (A.5): 37 controls for policies, access, assets, and supplier management
• People (A.6): 8 controls for HR security from hiring through termination
• Physical (A.7): 14 controls for facilities, equipment, and environmental protection
• Technological (A.8): 34 controls for endpoint, network, application, and data security

Organizational Controls (A.5): Governance and Management

• Threat intelligence (A.5.7) is a new control requiring analysis of relevant security threats
• Access control covers policy, identity management, authentication, and access rights management
• Supplier security includes ICT supply chain management and monitoring of services
• Incident management spans planning, response, learning, and evidence collection
• Business continuity and legal compliance controls ensure operational resilience

People Controls (A.6): Human Resource Security

• Pre-employment screening must be proportionate to data classification and perceived risks
• Employment terms must include information security responsibilities extending beyond termination
• Security awareness training must be appropriate to job function with regular updates
• Remote working controls have become critical since the shift to distributed work environments
• All personnel must have channels to report observed or suspected security events

Physical Controls (A.7): Facilities and Equipment

• Physical security monitoring (A.7.4) is a new control requiring continuous monitoring for unauthorized access
• Environmental threat protection covers natural disasters, fire, flood, and malicious physical attacks
• Clear desk and screen policies reduce risk of unauthorized information access
• Supporting utilities must be protected to prevent processing disruption
• Secure disposal or re-use requires verified removal of all sensitive data from equipment

Technological Controls (A.8): Technical Security Measures

• Configuration management (A.8.9), data masking (A.8.11), and DLP (A.8.12) are new controls
• Monitoring activities (A.8.16) is now a separate control requiring anomaly detection
• Web filtering (A.8.22) is a new control for managing access to external websites
• Secure development lifecycle covers requirements, architecture, coding, and testing
• Network security includes segregation, services security, and web filtering

Building Your Statement of Applicability

• The SoA must address all 93 controls with inclusion/exclusion justification for each
• Exclusions must be justified by risk assessment results, not by convenience or cost
• Each control entry should reference implementation status and supporting documentation
• The SoA should be maintained as a living document updated with risk assessment changes
• Start with risk assessment results then review all controls for general applicability

Related Resources

Other Compliance Guides