ISO 27001 Annex A Controls: All 93 Controls Explained (ISO 27001:2022)

ISO 27001 Annex A controls are the 93 reference controls in ISO/IEC 27001:2022, grouped into four themes: organizational (37), people (8), physical (14) and technological (34). They are not all mandatory. Your risk assessment decides which ones you need, and your Statement of Applicability records that decision for every control.

How is ISO 27001:2022 Annex A organized?

Annex A lists 93 controls under four themes, numbered by clause of the companion guidance standard ISO/IEC 27002:2022. The theme tells you what kind of safeguard a control is, not who owns it: an access review (5.18) sits in the organizational theme even though IT runs it.

Annex A is a reference set. Clause 6.1.3 of ISO/IEC 27001 requires you to compare the controls you selected through risk treatment with Annex A, so that nothing necessary is overlooked, and to produce a Statement of Applicability (SoA) that justifies inclusions and exclusions.

What changed in Annex A from 2013 to 2022?

The 2013 edition had 114 controls in 14 domains; the 2022 edition has 93 controls in 4 themes. According to the ISMS.online mapping, 24 controls were merged, 58 were updated and 11 are new (ISMS.online Annex A overview). The fewer controls reflect consolidation, not a lower bar.

The transition period for certificates issued against ISO/IEC 27001:2013 ended on 31 October 2025, so every valid certificate is now against the 2022 edition. If your internal documents still cite 2013 numbers such as A.9.2.5 or A.12.6.1, update them to the 2022 controls (5.18 access rights, 8.8 management of technical vulnerabilities) before your next audit.

Which 11 controls are new in ISO 27001:2022?

These controls have no direct equivalent in the 2013 edition:

For most software companies, 5.23, 8.9, 8.16 and 8.28 carry the most work: you need a cloud-service policy and supplier review, a defined baseline configuration, active monitoring of systems and a secure coding standard that developers actually follow.

What do the organizational controls (5.1–5.37) cover?

Organizational controls set how security is governed: policies, roles, assets, access, suppliers, incidents, continuity and legal obligations. They are the theme auditors read first, because every other control depends on them.

• Policies and governance (5.1–5.8): information security policy, roles and responsibilities, segregation of duties, management responsibilities, contact with authorities and special interest groups, threat intelligence (5.7) and security in project management.
• Assets and information (5.9–5.14): inventory of information and other associated assets, acceptable use, return of assets, classification, labelling and information transfer.
• Access and identity (5.15–5.18): access control rules, identity management, authentication information and access rights, including periodic access reviews.
• Suppliers (5.19–5.23): security in supplier relationships and agreements, the ICT supply chain, monitoring of supplier services and use of cloud services.
• Incidents (5.24–5.28): incident management planning, assessment, response, learning and collection of evidence.
• Continuity and compliance (5.29–5.37): security during disruption, ICT readiness, legal and contractual requirements, intellectual property, protection of records, privacy and PII, independent review, compliance with policies and documented operating procedures.

What do the people controls (6.1–6.8) cover?

The people theme covers the employee lifecycle from hiring to exit. It is the smallest theme but a common source of audit findings, because evidence must exist for every person in scope, not just for the policy.

What do the physical controls (7.1–7.14) cover?

Physical controls protect premises and equipment. They still apply to remote-first and cloud-native companies, though the scope may shrink to one office, a co-working desk and laptops at home.

• Secure areas (7.1–7.7): physical perimeters, entry controls, securing offices and facilities, physical security monitoring (7.4), protection against environmental threats, working in secure areas and clear desk and clear screen.
• Equipment (7.8–7.14): equipment siting, security of assets off-premises, storage media, supporting utilities, cabling, equipment maintenance and secure disposal or re-use.

For a cloud-hosted product, the data-centre controls are usually covered by your cloud provider's own certification. You still need to show that you reviewed that coverage under 5.23 and that your own offices and devices meet 7.7, 7.9 and 7.14.

What do the technological controls (8.1–8.34) cover?

The technological theme is where engineering teams spend most of their effort. It covers endpoints, access, vulnerabilities, logging, networks, cryptography and the software development lifecycle.

• Endpoints and access (8.1–8.5): user endpoint devices, privileged access rights, information access restriction, access to source code and secure authentication.
• Operations (8.6–8.19): capacity management, protection against malware, technical vulnerability management (8.8), configuration management (8.9), information deletion, data masking, data leakage prevention, backup, redundancy, logging (8.15), monitoring (8.16), clock synchronization, use of privileged utility programs and installation of software.
• Networks (8.20–8.23): network security, security of network services, segregation of networks and web filtering.
• Cryptography (8.24): use of cryptography, including key management.
• Secure development (8.25–8.34): secure development lifecycle, application security requirements, secure architecture, secure coding (8.28), security testing, outsourced development, separation of development, test and production environments, change management (8.32), test information and protection of systems during audit testing.

How do you decide which Annex A controls apply?

You decide applicability from your risk treatment plan, then record it control by control in the Statement of Applicability. For each of the 93 controls the SoA states whether it is included, why, whether it is implemented, and the justification for any exclusion.

1. Define the ISMS scope: which products, locations, teams and systems are in.
2. Run the risk assessment and choose treatments for each risk (see the ISO 27001 risk assessment guide).
3. List the controls those treatments need, then compare the list against all 93 Annex A controls.
4. Write the SoA with an inclusion or exclusion reason for each control.
5. Assign an owner and the evidence that proves each included control operates.

Exclusions need a real reason tied to scope. Secure coding (8.28) can be excluded if the organization develops no software in scope; cloud-service security (5.23) almost never can. "Hard to implement" is not a valid justification, and certification auditors check this in the Stage 1 review.

What are control attributes and do you need them?

ISO/IEC 27002:2022, the guidance standard behind Annex A, tags every control with five attributes: control type (preventive, detective, corrective), information security properties (confidentiality, integrity, availability), cybersecurity concepts (identify, protect, detect, respond, recover), operational capabilities and security domains. ISO/IEC 27001 does not require you to use them.

They are useful for filtering. A team that maps controls to NIST CSF or SOC 2 can use the cybersecurity-concept attribute to group controls, and a security lead can list all detective controls to check that monitoring is covered.

How do you implement Annex A controls efficiently?

Start from risk, reuse evidence and let existing tools produce it.

• Start from risk, not the list. Implementing all 93 controls at full depth before the risk assessment usually over-engineers low-risk areas and leaves real risks under-treated.
• Map before you collect. If you also run SOC 2 or HIPAA, one access review can serve ISO 27001 5.18 and SOC 2 CC6. Compare the two in ISO 27001 vs SOC 2.
• Use configuration as evidence. Branch protection and pull-request review records support 8.32 change management; cloud audit logs support 8.15 and 8.16. Auditors accept system-generated evidence when it is collected consistently over the audit period.

How does pTrackly help with Annex A?

pTrackly includes the ISO 27001:2022 framework with its requirements, controls, policy templates and recurring evidence tasks. Controls are shared across frameworks, so a policy or task that also serves SOC 2 or HIPAA counts once for all of them. The risk register links each treatment action to control references such as "ISO 27001 A.5.17", and the asset inventory gives you the record for 5.9. Your team still decides applicability, writes the SoA justifications and operates the controls; the accredited certification body audits and certifies. See pTrackly for ISO 27001 and how long ISO 27001 certification takes.

Frequently asked questions

How many controls are in ISO 27001 Annex A?

ISO/IEC 27001:2022 Annex A has 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological. The 2013 edition had 114 controls in 14 domains.

Are all 93 Annex A controls mandatory?

No. You select controls through risk treatment and justify every inclusion and exclusion in the Statement of Applicability. The clauses 4 to 10 of the standard, by contrast, are mandatory for certification.

Is there a difference between ISO 27001 and ISO 27002 controls?

ISO/IEC 27001 Annex A lists each control in one or two sentences. ISO/IEC 27002:2022 uses the same 93 controls and numbering and adds purpose, implementation guidance and attributes for each. Certification is against ISO/IEC 27001 only.

Can a cloud-only company exclude the physical controls?

Rarely all of them. Data-centre controls are usually inherited from the cloud provider, but office access, clear desk and screen (7.7), off-premises equipment (7.9) and secure disposal of laptops (7.14) still apply to your own staff and devices.

References:

• ISO/IEC 27001:2022, Information security management systems (iso.org/standard/82875.html)
• ISO/IEC 27002:2022, Information security controls (iso.org/standard/75652.html)
• ISMS.online: ISO 27001 Annex A (isms.online/iso-27001/annex-a)