Skip to Content
ISO 27001Annex A (93 controls)

Annex A of ISO 27001: the 93 controls

Annex A of ISO/IEC 27001:2022  contains a catalogue of 93 security controls. You can buy the standard from NEN , the Dutch standards body, and ISO 27002  gives detailed implementation guidance. These controls form a reference list of possible security measures you can implement to reduce risks.

A common misunderstanding is that you must implement all 93 controls. You do not. You select the controls that are relevant to your risk profile and record your choices in the Statement of Applicability. For every control you do not apply, you must explain why not.

The 2022 version reorganised the controls compared with the 2013 version. Where there were previously 114 controls in 14 categories, there are now 93 controls in four categories. Some old controls have been merged, and new controls have been added to respond to modern threats and technologies.

ISO 27002:2022  gives detailed implementation guidance for each control. If you want to go deeper into the practical side, that standard is a valuable addition.

The four themes of ISO 27001 Annex A

In the 2022 version, the 93 controls are divided into four themes that together cover the full range of information security. The table below gives an overview. Below it, we explain what each theme covers.

ThemeAnnexNumber of controlsWhat it covers
OrganisationalA.537Policies, processes, roles, suppliers
PeopleA.68Screening, awareness, behaviour
PhysicalA.714Buildings, rooms, equipment
TechnologicalA.834Access, encryption, logging, network

Organisational controls focus on policies, processes, roles and responsibilities. They form the foundation on which the other controls rest. Without good policies and clear procedures, technical controls are of little use.

Annex A as Excel or PDF?

Many people look for Annex A as an Excel or PDF file to work with. Here is how it works. The full text of Annex A, with the exact wording of each control, is protected by copyright. You may not distribute it for free. You buy the official text from NEN  for roughly €250.

What you can use for free is the list of numbers and titles of the 93 controls (A.5.1 up to and including A.8.34) to set up your own working file. That is exactly what a Statement of Applicability is.

What you are looking forFree?Where
Full standard text (all requirements per control)No, paidNEN 
List of numbers and titlesYesOn this page, below
Your own SoA template in ExcelYes, make it yourselfSee Statement of Applicability

Be careful with free “Annex A Excel” downloads that contain the full standard text. These are often illegal copies. You then cannot be sure you have the current 2022 version, and you run a legal risk.

Want to make a usable overview in Excel yourself? Start with the structure of four themes (A.5 up to and including A.8) and enter the control numbers that we discuss by theme below. Combine this with your risk assessment to decide which controls you apply.

Organisational controls (A.5)

The organisational controls are the largest category, with 37 controls. They cover how you structure and manage information security as an organisation.

A.5.1 Information security policy

You must have an information security policy that is approved by management and communicated to all relevant parties. This policy sets the direction for all other security activities. It must be reviewed regularly and updated when significant changes occur.

A.5.2 Roles and responsibilities

Responsibilities for information security must be defined and assigned. Everyone must know what is expected of them. This includes not only the security officer, but everyone whose work affects security.

A.5.3 Segregation of duties

Tasks and responsibilities that conflict must be separated to reduce the risk of fraud or errors. Someone who can initiate transactions should not also be able to approve them. The person who writes code should not also be able to put it into production without a review.

A.5.4 Management responsibilities

Management must actively support the policy and make sure employees follow the rules. This is more than signing a document. It requires visible involvement.

A.5.5-5.6 Contact with authorities and special interest groups

You must maintain contacts with relevant authorities, such as the NCSC  (the Dutch National Cyber Security Centre) or the Autoriteit Persoonsgegevens  (the Dutch Data Protection Authority), and with special interest groups that share information about threats and best practices.

A.5.7 Threat intelligence

You must collect and analyse information about threats so you can adjust your security measures to current risks. This is a new control in the 2022 version, which underlines the importance of proactive threat analysis.

A.5.8 Information security in project management

Information security must be built into project management. For every project, you must think about the security implications, not only after the system has been built.

A.5.9-5.14 Information inventory and classification

You must know what information you have, who is responsible for it, and how sensitive it is. Based on that, you can take suitable protective measures. Sensitive information deserves stronger protection than public information. Read how to approach this in the asset register (A.5.9) and in classifying information (A.5.12 and A.5.13).

A.5.15-5.18 Identity and access management

This group of controls is about who has access to what. You must have an identity management process, grant access rights on a need-to-know basis, and review regularly whether access rights are still appropriate. For passwords and other login credentials (A.5.17), see the example on the password policy page.

A.5.19-5.23 Supplier management

Suppliers and partners can pose a risk to your information security. You must set requirements for suppliers, record these requirements in contracts, and monitor whether suppliers meet them. This is especially relevant in a world where many organisations depend on cloud providers and other external service providers.

A.5.24-5.28 Incident management

You must be prepared for security incidents. This includes having an incident response plan, recording incidents, learning from incidents, and collecting evidence for any legal follow-up. You will find the procedure and a sample incident register at handling information security incidents.

A.5.29-5.30 Continuity and compliance

Information security must be included in your business continuity planning. You must also identify which legal and contractual requirements apply to you and make sure you comply with them.

A.5.31-5.36 Intellectual property and privacy

You must respect third-party intellectual property, protect personal data in line with the GDPR (AVG in Dutch) , and make sure your security practices are assessed independently.

A.5.37 Documented operating procedures

Procedures for information processing activities must be documented and available to the employees who need them.

People controls (A.6)

The eight people controls recognise that security ultimately depends on people. The best technology is worthless if employees open phishing emails or write their passwords on a sticky note.

A.6.1 Screening

Before you hire someone, you must carry out background checks that suit the role and the access the person will have. For roles with access to very sensitive information, more extensive checks are justified.

A.6.2 Terms and conditions of employment

Contracts with employees and contractors must include their responsibilities for information security. This makes clear what is expected and creates a legal basis for enforcement.

A.6.3 Information security awareness and training

All employees must receive suitable awareness training and be regularly updated on current threats and the security policy. A one-off training at the start of employment is not enough. Awareness must be maintained continuously.

SANS , KnowBe4  and various Dutch providers offer awareness programmes, but you can also set up programmes in-house.

A.6.4 Disciplinary process

There must be a formal disciplinary process for employees who breach the security policy. It does not need to be harsh, but ignoring the rules must have consequences.

A.6.5 Responsibilities after termination of employment

When someone leaves the organisation, security responsibilities that continue after departure must be communicated, and access rights must be withdrawn in good time.

A.6.6-6.7 Confidentiality and remote working

Confidentiality agreements must be used where needed. For remote working, suitable security measures must apply. This is more relevant than ever in the post-COVID era. A sample policy is on the working from home and BYOD page.

A.6.8 Reporting security events

Employees must know how to report security events, and they must feel safe doing so. A culture in which people hide problems for fear of punishment is a security risk.

Physical controls (A.7)

The fourteen physical controls protect the tangible parts of your information environment. In an increasingly digital world, physical security is sometimes a blind spot.

A.7.1-7.4 Physical security perimeters

You must define physical boundaries around sensitive areas, implement access controls, secure offices and facilities, and monitor for physical threats. The level of protection depends on how sensitive what you are protecting is.

A.7.5-7.8 Secure areas

Within physical perimeters there may be secure areas with additional measures, such as server rooms or data centres. These areas must be protected against unauthorised access and against environmental risks such as fire or flooding. A.7.7 also asks for a clear desk and a locked screen. See the clean desk policy with example.

A.7.9-7.14 Equipment and media

Equipment must be physically protected, maintained, and disposed of securely when no longer used. Storage media with sensitive information need special attention. You do not want old hard drives containing customer data to end up in the rubbish bin.

Technological controls (A.8)

The 34 technological controls form the digital line of defence. These are the controls that most people associate with cybersecurity.

A.8.1-8.4 Endpoints and privileged access

Endpoints (laptops, workstations, mobile devices) must be secured. Access to privileged accounts must be restricted and monitored, and access to source code must be controlled.

A.8.5-8.6 Authentication and capacity management

Secure authentication mechanisms must be used, including strong passwords and preferably multi-factor authentication. You must also monitor the capacity of your systems to prevent availability problems.

A.8.7-8.10 Malware, vulnerabilities and configuration

Protection against malware is essential. Vulnerabilities must be identified and patched in good time (A.8.8, see vulnerability management and patching). System configurations must be recorded, controlled and hardened against attacks.

The Center for Internet Security (CIS)  publishes benchmarks for hardening commonly used systems. The NCSC  provides guidance specifically for the Dutch context.

A.8.11-8.13 Data protection

Data must be protected at rest, in transit and during processing. Think of encryption, data loss prevention, and secure deletion of data that is no longer needed. Backups fall under A.8.13. Read how to draw up a backup policy.

A.8.14-8.16 Redundancy and logging

Critical systems must have redundancy to guarantee availability. Activities must be logged, logs must be protected against tampering, and system clocks must be synchronised for reliable timestamps. Read more on the logging and monitoring (A.8.15 and A.8.16) page.

A.8.17-8.19 Networks and web services

Networks must be secured and segmented. Web applications and web services deserve special attention because they are exposed to the internet. The OWASP Top 10  is a valuable resource for understanding and mitigating common web vulnerabilities.

A.8.20-8.24 Application security

Applications must be developed, tested and configured securely. This includes secure coding practices, security testing, and securing development, test and production environments.

A.8.25-8.29 Change management and testing

Changes to systems must be controlled to prevent updates from introducing new vulnerabilities. Security measures must be tested to verify that they work as intended.

A.8.30-8.34 Outsourcing and separation

When you outsource services, you must manage their security. Development, test and production environments must be separated to prevent errors or malicious intent in a test environment from affecting production systems.

New controls in ISO 27001:2022

The 2022 version introduced eleven new controls that respond to developments since 2013:

  • A.5.7 Threat intelligence: proactively collecting and using information about threats
  • A.5.23 Information security for cloud services: specific attention to cloud environments
  • A.5.30 ICT readiness for business continuity: the IT aspects of continuity planning
  • A.7.4 Physical security monitoring: monitoring for physical threats
  • A.8.9 Configuration management: managing system configurations
  • A.8.10 Information deletion: securely wiping data
  • A.8.11 Data masking: protecting sensitive data through masking
  • A.8.12 Data leakage prevention: preventing unauthorised data leaks
  • A.8.16 Monitoring activities: detecting unusual behaviour
  • A.8.23 Web filtering: restricting access to harmful websites
  • A.8.28 Secure coding: secure software development practices

These new controls reflect the changed threat landscape and the shift towards cloud computing and continuous software development.

Creating the ISO 27001 Statement of Applicability

For every control in Annex A, you must document whether you apply it or not, and why. This document, the Statement of Applicability (SoA), is mandatory and forms a central part of your ISMS.

A good SoA contains the following for each control:

  • Whether the control is selected (yes or no)
  • The justification for the choice (why or why not)
  • The implementation status (implemented, in progress, planned)
  • A reference to relevant documentation

The SoA is not a static document. When your risk profile changes, controls can become relevant or irrelevant. Review the SoA regularly as part of your ISMS maintenance.

Want to draw up the SoA step by step, with a sample row? Read the separate page on the Statement of Applicability.

A common mistake is copying a standard SoA from the internet. Auditors see through this. Your SoA must reflect how your organisation has implemented the standard, not what a standard template looks like.

Practical tips

Do not start with Annex A. Start with the risk assessment. Annex A is a toolbox from which you select based on your risks. It is not a checklist that you work through from A to Z.

Document what you already do. Many organisations have already implemented controls without calling them that. A firewall, antivirus software, access management: you probably have more than you think.

Be honest about what you do not do. If a control is not relevant to your organisation, say so. A small consultancy without its own server room does not need to implement physical security measures for data centres.

Use existing sources. The NCSC  provides practical guidance. The CIS Controls  prioritise technical measures. ISO 27002  offers detailed implementation advice.

Working on this further

Are you working on access management? With an access rights matrix for ISO 27001, you record which roles get access, who approves that choice, and how you check its implementation.

More information

Requirements of the standardISO 27002 explained