Annex A is the part of ISO/IEC 27001 most people picture when they hear “ISO 27001” — the list of security controls. In the 2022 version there are 93 controls organised into four themes. Here is what that means in practice.
The four themes
| Theme | Count | What it covers |
|---|---|---|
| A.5 Organisational | 37 | Policies, roles, suppliers, incidents, compliance |
| A.6 People | 8 | Hiring, training, leaving, remote work |
| A.7 Physical | 14 | Premises, equipment, media, cabling |
| A.8 Technological | 34 | Access, backups, logging, encryption, development |
A.5 — Organisational (37)
This is the skeleton of the system: information security policy (5.1), roles and responsibilities, classification of information, access control, supplier relationships, incident management (5.24–5.28), legal and contractual requirements. It also contains the new controls for threat intelligence (5.7), information security for the use of cloud services (5.23) and ICT readiness for business continuity (5.30).
A.6 — People (8)
Screening (6.1), terms and conditions of employment (6.2), awareness, education and training (6.3), disciplinary process (6.4), responsibilities after termination (6.5), confidentiality agreements (6.6), remote working (6.7) and event reporting (6.8). Few in number — but this is where most breaches happen.
A.7 — Physical (14)
Perimeters and physical entry, physical security monitoring (7.4 — a new control), clear desk and clear screen (7.7), equipment protection, storage media, cabling and secure disposal (7.14).
A.8 — Technological (34)
The biggest group for the IT team: endpoint devices (8.1), privileged access (8.2), authentication (8.5), protection against malware (8.7), vulnerability management (8.8), backup (8.13), logging (8.15), cryptography (8.24) and secure development.
Which 11 controls are new in 2022?
- 5.7 Threat intelligence
- 5.23 Information security for use of cloud services
- 5.30 ICT readiness for business continuity
- 7.4 Physical security monitoring
- 8.9 Configuration management
- 8.10 Information deletion
- 8.11 Data masking
- 8.12 Data leakage prevention
- 8.16 Monitoring activities
- 8.23 Web filtering
- 8.28 Secure coding
The transition period from the 2013 version ended on 31 October 2025 — all certificates today are against ISO/IEC 27001:2022.
Are all 93 controls mandatory?
No. This is the most common misunderstanding. The standard requires a risk assessment, and based on it you decide which controls apply. The decision is documented in the Statement of Applicability (SoA) — for each of the 93 controls you state whether it applies, why, and if not, why not.
For example, a company with no in-house development can justifiably exclude some of the secure-coding controls. A company with no physical office will apply the physical controls far more narrowly.
What is mandatory are clauses 4–10 of the standard — context, leadership, planning, support, operation, performance evaluation and improvement. Annex A is a catalogue you choose from based on your risk.
Where to start?
- Gap analysis — where you are today against the standard.
- Asset register and risk assessment — what you protect and from what.
- SoA — which controls you apply.
- Implementation — start with the controls that have the most impact: MFA, backups, access management, training.
The most common mistake is starting with the documents. Start with the risk — the documents will follow.