ISO 27001 Requirements: Complete Guide to Annex A Controls
ISO 27001 is the international standard for information security management systems (ISMS). It requires organizations to systematically manage information security risks through a structured framework of policies, processes, and controls. The 2022 revision reorganized Annex A into 4 themes with 93 controls (down from 14 domains and 114 controls). Certification requires an accredited third-party audit. This guide covers the key requirements and controls you need to implement.
Table of Contents
ISMS Core Requirements (Clauses 4-10)
The mandatory clauses that define how to establish, implement, maintain, and continually improve your information security management system.
Context of the Organization
You must understand your organization, its context, the needs of interested parties (customers, regulators, etc.), and define the scope of your ISMS. This means documenting what your ISMS covers and the internal/external factors that affect it.
Leadership and Commitment
Top management must demonstrate leadership by establishing an information security policy, assigning roles and responsibilities, and ensuring the ISMS is integrated into business processes. Management must actively participate, not just sign off.
Planning: Risk Assessment and Treatment
You must establish a risk assessment process that identifies information security risks, analyzes their likelihood and impact, and evaluates them against your risk criteria. A risk treatment plan must specify how each risk will be addressed (mitigate, accept, transfer, or avoid).
Statement of Applicability
You must produce a Statement of Applicability (SoA) that lists all Annex A controls, indicates which are applicable and which are not, justifies exclusions, and maps controls to your risk treatment plan. The SoA is a key document auditors review.
Performance Evaluation
You must monitor, measure, analyze, and evaluate your ISMS performance. This includes internal audits at planned intervals and management reviews to ensure the ISMS remains suitable, adequate, and effective.
Improvement
When nonconformities are identified, you must take corrective action. You must also continually improve the suitability, adequacy, and effectiveness of the ISMS. This means documenting nonconformities, root cause analysis, and corrective actions.
Annex A: Organizational Controls (A.5)
Controls related to information security policies, roles, responsibilities, and organizational aspects of security management.
Policies for Information Security
You must define, approve, publish, and communicate a set of information security policies. These policies must be reviewed at planned intervals or when significant changes occur.
Information Security Roles and Responsibilities
All information security responsibilities must be defined and allocated. Everyone must know their security responsibilities and be held accountable for fulfilling them.
Information Security for Use of Cloud Services
You must establish processes for acquisition, use, management, and exit from cloud services. This includes evaluating cloud provider security, defining responsibilities, and planning for cloud service termination.
Annex A: People Controls (A.6)
Controls related to human resource security including screening, awareness, training, and disciplinary processes.
Screening
Background verification checks on all candidates must be carried out before hiring and at regular intervals, proportional to the business requirements and classification of information they will access.
Information Security Awareness, Education and Training
All personnel must receive appropriate awareness education, training, and regular updates on your information security policies. Training must be relevant to their job function.
Annex A: Physical Controls (A.7)
Controls related to physical security perimeters, entry controls, and protection of equipment.
Physical Security Perimeters
Security perimeters must be defined and used to protect areas containing information and information processing facilities. This includes office buildings, data centers, and any location where sensitive data is processed or stored.
Annex A: Technological Controls (A.8)
Controls related to technical security measures including access control, cryptography, malware protection, and vulnerability management.
User Endpoint Devices
Information stored on, processed by, or accessible via user endpoint devices must be protected. This includes laptops, phones, tablets, and any BYOD devices with policies covering encryption, patching, and remote wipe capabilities.
Secure Authentication
Secure authentication technologies and procedures must be established based on access control policies. This includes multi-factor authentication, password policies, and protection against brute-force attacks.
Management of Technical Vulnerabilities
You must obtain timely information about technical vulnerabilities, evaluate your exposure, and take appropriate measures. This includes regular vulnerability scanning, patch management, and penetration testing.
Use of Cryptography
Rules for the effective use of cryptography, including key management, must be defined and implemented. This covers encryption of data at rest and in transit, key generation, storage, rotation, and destruction.
Monitoring Activities
Networks, systems, and applications must be monitored for anomalous behavior, and appropriate actions taken to evaluate potential security incidents. This includes SIEM, log analysis, and alerting.
Frequently Asked Questions
What is the difference between ISO 27001 and SOC 2?
ISO 27001 is an international standard with formal certification by accredited bodies, valid for 3 years with annual surveillance audits. SOC 2 is a US-based attestation standard resulting in an auditor report, not a certification. ISO 27001 requires a full ISMS, while SOC 2 is criteria-based. Many organizations pursue both.
How long does ISO 27001 certification take?
Most organizations need 6-12 months to implement an ISMS and prepare for certification. The certification audit itself takes 1-2 weeks depending on organization size. Using PoliWriter to generate your policy suite can significantly reduce the documentation phase.
How much does ISO 27001 certification cost?
Certification costs vary by organization size. Small companies typically spend $15,000-$40,000 on the audit alone, plus internal costs for implementation. Larger organizations may spend $50,000-$100,000+. PoliWriter helps reduce the policy documentation cost significantly.
What changed in ISO 27001:2022?
The 2022 revision reorganized Annex A from 14 domains with 114 controls to 4 themes (Organizational, People, Physical, Technological) with 93 controls. Eleven new controls were added covering threat intelligence, cloud security, data masking, and more.
Is ISO 27001 mandatory?
ISO 27001 is not legally mandatory in most jurisdictions, but it is increasingly required by enterprise customers, government contracts, and regulatory frameworks. It is often a prerequisite for doing business with large organizations, especially in Europe.
What policies do I need for ISO 27001?
Key policies include an ISMS policy, risk management policy, Statement of Applicability, access control policy, information security policy, incident management procedure, business continuity plan, and acceptable use policy. PoliWriter generates all required ISO 27001 policies.
What is the Statement of Applicability?
The Statement of Applicability (SoA) is a mandatory ISO 27001 document that lists all Annex A controls, states which are applicable to your organization, justifies any exclusions, and references the implementation status. It is one of the first documents auditors review.
Other Requirements Guides
Generate ISO 27001 policies automatically
PoliWriter creates all the policies you need to satisfy ISO 27001 requirements, customized to your organization. AI-powered, audit-ready, hours not months.
Get Started Free