iso27001partnersISO 27001 Annex A controls: all 93, by theme
The withdrawn ISO/IEC 27001:2013 had 114 in 14 clauses. The count fell because controls were merged, not because requirements were removed — 11 of the 93 did not exist at all before 2022.
Two things are worth settling before the list. The edition year belongs with every control count, because both numbers are still in circulation. And Annex A is not what you are certified against — clauses 4 to 10 are. Annex A is the reference set you check your risk treatment against. The full list of all 93 ISO 27001 controls is further down, by theme.
The same diagram as a table
| Theme | Reference | Controls | Covers |
|---|---|---|---|
| Organisational | A.5 | 37 | Policies, supplier relationships, incident management, legal and contractual requirements, and the whole of how the ISMS is governed. |
| People | A.6 | 8 | Screening, terms of employment, awareness, disciplinary process, responsibilities after employment ends, and remote working. |
| Physical | A.7 | 14 | Perimeters, entry, equipment siting, clear desk and screen, secure disposal, and physical security monitoring. |
| Technological | A.8 | 34 | Endpoints, access rights, cryptography, logging, secure development and the other technical controls. |
| ISO/IEC 27001:2022 total | 93 | Four themes | |
| ISO/IEC 27001:2013 total | 114 | 14 clauses, A.5 to A.18. Withdrawn. | |
The four themes
| Theme | Reference | Controls | What sits in it |
|---|---|---|---|
| Organisational | A.5 | 37 | Policies, supplier relationships, incident management, legal and contractual requirements, and the whole of how the ISMS is governed. |
| People | A.6 | 8 | Screening, terms of employment, awareness, disciplinary process, responsibilities after employment ends, and remote working. |
| Physical | A.7 | 14 | Perimeters, entry, equipment siting, clear desk and screen, secure disposal, and physical security monitoring. |
| Technological | A.8 | 34 | Endpoints, access rights, cryptography, logging, secure development and the other technical controls. |
The arrangement is the headline change from 2013, where the controls sat in 14 clauses numbered A.5 to A.18. The four themes are easier to allocate to owners, which matters more than it sounds: most of the practical failure in an ISMS is a control that nobody thinks belongs to them.
Each control also carries attributes in ISO/IEC 27002:2022 — control type, information security properties, cybersecurity concepts, operational capabilities and security domains — which exist so you can slice the set in whatever way suits your organisation. They are a navigation aid, not a requirement, and no auditor will ask you to have used them.
The 11 genuinely new controls
These have no counterpart in the 2013 edition. If your management system was built before October 2022 and has not been revisited since, this is the list to start from.
| Reference | Control | Why it is new |
|---|---|---|
| A.5.7 | Threat intelligence | The 2013 edition had nothing about knowing what is being used against you. Expect to be asked what sources you use and what you do with what they tell you. |
| A.5.23 | Information security for use of cloud services | Cloud was treated as ordinary supplier risk in 2013. It now has its own control covering acquisition, use, management and exit. |
| A.5.30 | ICT readiness for business continuity | Business continuity for the technology, separately from business continuity in general. |
| A.7.4 | Physical security monitoring | The physical counterpart to logging. Monitoring of premises for unauthorised access. |
| A.8.9 | Configuration management | Configurations have to be established, documented, implemented, monitored and reviewed. In practice this is where infrastructure-as-code earns its keep. |
| A.8.10 | Information deletion | Deleting information when it is no longer required — which is also a data protection obligation, so the two can be evidenced together. |
| A.8.11 | Data masking | Masking in line with access control policy. Relevant, for example, to non-production environments containing real data. |
| A.8.12 | Data leakage prevention | Detecting and preventing unauthorised disclosure. Rarely satisfied by buying a product. |
| A.8.16 | Monitoring activities | Networks, systems and applications monitored for anomalous behaviour, with defined responses. |
| A.8.23 | Web filtering | Managing which external sites can be reached, to reduce exposure to malicious content. |
| A.8.28 | Secure coding | Secure coding principles applied to software development. Doing it is not the same as evidencing it. |
Where the count went
11 new, 24 formed by merging controls from the 2013 edition, and 58 updated. That is 93. A smaller number of controls describing more ground is a reorganisation, not a relaxation.
Annex A is not a checklist, and treating it as one is expensive
The sequence the standard actually sets out runs the other way from the one most teams assume. You assess risk (clause 6.1.2), decide how to treat it (6.1.3), and then compare the controls your treatment produced against Annex A to verify that nothing necessary was overlooked. Annex A is the cross-check, not the starting point.
Clause 6.1.3 d) then asks for a Statement of Applicability containing the necessary controls, the justification for including them, whether they are implemented, and the justification for excluding any Annex A control you left out. That last part is the one organisations under-do. “Not applicable” is a conclusion; the standard asks for the reasoning that produced it.
There is a commercial consequence. Approaching the standard as 93 controls to implement produces an enormous amount of unnecessary work and an ISMS that does not reflect what your organisation actually risks. It is also how a consultancy engagement gets quoted at a size nobody needed.
What auditors sample, and what they find
The controls that produce findings are rarely the exotic ones. They are the ones where the activity is real but the evidence is not:
- Monitoring activities (A.8.16) — the alerting exists, but nobody can show what was reviewed, by whom, or what happened next.
- Configuration management (A.8.9) — configurations are managed in practice, but not documented, monitored and reviewed in a way that can be sampled. Teams running everything as code can be close to compliant and still short of evidence.
- Secure coding (A.8.28) — review happens on every pull request, and there is no stated principle, no record of training, and nothing tying it to the control.
- Supplier controls (A.5.19 to A.5.23) — a folder of supplier certificates that nobody has checked for expiry or scope. Since certificates against the withdrawn edition expired on 31 October 2025, that folder is worth a pass.
- Physical controls in a remote-first company (A.7) — waved away rather than reasoned about. Homes and devices are premises for this purpose, and the exclusions need the same justification as everything else.
All 93 Annex A controls, by theme
The full list, by number and title. ISO/IEC 27001:2022's foreword says its main changes include that “the text has been aligned with the harmonized structure for management system standards and ISO/IEC 27002:2022.” The titles below are taken from ISO/IEC 27002:2022's published contents; in Annex A each carries the prefix “A.” (5.1 is A.5.1). We list titles only — the control text and guidance are in the standards themselves.
Organisational controls (A.5, 37)
| Control | Title |
|---|---|
| A.5.1 | Policies for information security |
| A.5.2 | Information security roles and responsibilities |
| A.5.3 | Segregation of duties |
| A.5.4 | Management responsibilities |
| A.5.5 | Contact with authorities |
| A.5.6 | Contact with special interest groups |
| A.5.7 | Threat intelligence |
| A.5.8 | Information security in project management |
| A.5.9 | Inventory of information and other associated assets |
| A.5.10 | Acceptable use of information and other associated assets |
| A.5.11 | Return of assets |
| A.5.12 | Classification of information |
| A.5.13 | Labelling of information |
| A.5.14 | Information transfer |
| A.5.15 | Access control |
| A.5.16 | Identity management |
| A.5.17 | Authentication information |
| A.5.18 | Access rights |
| A.5.19 | Information security in supplier relationships |
| A.5.20 | Addressing information security within supplier agreements |
| A.5.21 | Managing information security in the ICT supply chain |
| A.5.22 | Monitoring, review and change management of supplier services |
| A.5.23 | Information security for use of cloud services |
| A.5.24 | Information security incident management planning and preparation |
| A.5.25 | Assessment and decision on information security events |
| A.5.26 | Response to information security incidents |
| A.5.27 | Learning from information security incidents |
| A.5.28 | Collection of evidence |
| A.5.29 | Information security during disruption |
| A.5.30 | ICT readiness for business continuity |
| A.5.31 | Legal, statutory, regulatory and contractual requirements |
| A.5.32 | Intellectual property rights |
| A.5.33 | Protection of records |
| A.5.34 | Privacy and protection of PII |
| A.5.35 | Independent review of information security |
| A.5.36 | Compliance with policies, rules and standards for information security |
| A.5.37 | Documented operating procedures |
People controls (A.6, 8)
| Control | Title |
|---|---|
| A.6.1 | Screening |
| A.6.2 | Terms and conditions of employment |
| A.6.3 | Information security awareness, education and training |
| A.6.4 | Disciplinary process |
| A.6.5 | Responsibilities after termination or change of employment |
| A.6.6 | Confidentiality or non-disclosure agreements |
| A.6.7 | Remote working |
| A.6.8 | Information security event reporting |
Physical controls (A.7, 14)
| Control | Title |
|---|---|
| A.7.1 | Physical security perimeters |
| A.7.2 | Physical entry |
| A.7.3 | Securing offices, rooms and facilities |
| A.7.4 | Physical security monitoring |
| A.7.5 | Protecting against physical and environmental threats |
| A.7.6 | Working in secure areas |
| A.7.7 | Clear desk and clear screen |
| A.7.8 | Equipment siting and protection |
| A.7.9 | Security of assets off-premises |
| A.7.10 | Storage media |
| A.7.11 | Supporting utilities |
| A.7.12 | Cabling security |
| A.7.13 | Equipment maintenance |
| A.7.14 | Secure disposal or re-use of equipment |
Technological controls (A.8, 34)
| Control | Title |
|---|---|
| A.8.1 | User endpoint devices |
| A.8.2 | Privileged access rights |
| A.8.3 | Information access restriction |
| A.8.4 | Access to source code |
| A.8.5 | Secure authentication |
| A.8.6 | Capacity management |
| A.8.7 | Protection against malware |
| A.8.8 | Management of technical vulnerabilities |
| A.8.9 | Configuration management |
| A.8.10 | Information deletion |
| A.8.11 | Data masking |
| A.8.12 | Data leakage prevention |
| A.8.13 | Information backup |
| A.8.14 | Redundancy of information processing facilities |
| A.8.15 | Logging |
| A.8.16 | Monitoring activities |
| A.8.17 | Clock synchronization |
| A.8.18 | Use of privileged utility programs |
| A.8.19 | Installation of software on operational systems |
| A.8.20 | Networks security |
| A.8.21 | Security of network services |
| A.8.22 | Segregation of networks |
| A.8.23 | Web filtering |
| A.8.24 | Use of cryptography |
| A.8.25 | Secure development life cycle |
| A.8.26 | Application security requirements |
| A.8.27 | Secure system architecture and engineering principles |
| A.8.28 | Secure coding |
| A.8.29 | Security testing in development and acceptance |
| A.8.30 | Outsourced development |
| A.8.31 | Separation of development, test and production environments |
| A.8.32 | Change management |
| A.8.33 | Test information |
| A.8.34 | Protection of information systems during audit testing |
Annex A, ISO 27002, and which one to buy
Annex A gives you the control titles and a line each. ISO/IEC 27002:2022, Information security controls is a separate standard covering the same controls at length: purpose, implementation guidance and other information for each one. You are certified against ISO 27001; ISO 27002 is what your team reads when working out what a control means in your context.
Neither is free. If you are buying one to start with, buy ISO 27001, because it contains the clauses you are actually audited against. ISO 27002 becomes worth having once somebody is doing the implementation work and arguing about what “adequate” means.
Where to go next
- ISO 27001 vs ISO 27002
- What the words mean
- The certification process
- Running the ISMS in your own tools
- Who should do this work
- What it will cost
Common questions
What are the 93 ISO 27001 Annex A controls?
They are listed on this page by number and title: 37 organisational (A.5), 8 people (A.6), 14 physical (A.7) and 34 technological (A.8), as in ISO/IEC 27002:2022. Which apply to you is decided in your Statement of Applicability.
How many controls does ISO 27001 have?
ISO/IEC 27001:2022 lists 93 controls in Annex A, arranged in four themes: organisational (37), people (8), physical (14), technological (34). The withdrawn ISO/IEC 27001:2013 had 114 in 14 clauses numbered A.5 to A.18. Always attach the edition to the number: a document that says 114 today was written before October 2022 and has not been revisited.
Did the 2022 edition remove requirements?
No. The count fell from 114 to 93 because controls were merged, not dropped. Of the 93, 11 are genuinely new, 24 were formed by merging controls from the 2013 edition, and 58 are updated versions of existing ones. The scope of what is expected went up, not down — threat intelligence, cloud services, secure coding and data leakage prevention were not there before.
Do we have to implement all of them?
No, and a Statement of Applicability that applies all 93 without reasoning is as much of a finding as one that excludes too many. Annex A is a reference set. Clause 6.1.3 requires you to compare the controls your risk treatment produced against Annex A to check you have not missed anything, then produce a Statement of Applicability giving the justification for inclusions and for exclusions. The reasoning is the deliverable, not the count.
What is the difference between ISO 27001 Annex A and ISO 27002?
Annex A of ISO/IEC 27001 gives the control titles in one page each, as a reference set to check your risk treatment against. ISO/IEC 27002:2022 is the separate, much longer standard that explains each of the same controls: purpose, guidance and other information. You are certified against ISO 27001. ISO 27002 is what your team reads when deciding what a control actually means in your organisation.
Which controls are hardest to evidence?
From the shape of the standard rather than any survey: the ones requiring evidence of an ongoing activity rather than a document. Monitoring activities, configuration management and secure coding are all things competent teams do daily and rarely record in a form an auditor can sample. The other recurring gap is the exclusion justification in the Statement of Applicability — writing “not applicable” where the standard asks for the reason.
Do the four themes map onto our teams?
Loosely, and it is worth not forcing it. The technological theme is the largest at 34 controls and is mostly engineering. Organisational, at 37, is the largest single block and spans legal, procurement, HR and management. People, at 8, is HR almost entirely. Physical, at 14, belongs to whoever runs your premises — and for a fully remote company it still has to be reasoned about in the Statement of Applicability, not waved away.
What changed with the 2024 amendment?
ISO/IEC 27001:2022/Amd 1:2024, Climate action changes, published February 2024. Two climate-change additions to clause 4: whether climate change is a relevant issue must be determined, and interested parties may have climate-related requirements. It changed no Annex A control and added no new control. If a supplier tells you the amendment added controls, they are mistaken.
Sources cited on this page
- ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements
- ISO/IEC 27002:2022, Information security controls
- ISO/IEC 27001:2022/Amd 1:2024, Climate action changes
- IAF MD 26:2023, Transition requirements for ISO/IEC 27001:2022
Every figure above was read from the source it is attributed to on 20 September 2026. Figures that are our own arithmetic rather than a published rule are labelled as estimates wherever they appear. How we check this.
Work out which of these you already satisfy
Say what exists today and a consultancy can tell you what is genuinely missing rather than quoting for all 93 of them.
Your enquiry is ready to send
Here is what happens after you submit:
- We pass your answers only to ISO 27001 consultancies taking enquiries for your sector, when one is.
- No more than three may contact you, and only using the details you gave.
- You decide who, if anyone, you speak to. You are committed to nothing.
We are not a certification body and cannot issue, arrange or influence a certificate. Only a UKAS-accredited certification body can do that, and you appoint it yourself.