Skip to main content
EU / international framework

ISO 27001:2022 Annex A — the 93 controls, and how to run them

The international standard for an Information Security Management System (ISMS): 93 Annex A controls, a risk-based approach and a clear path to certification.

What is ISO 27001?

ISO/IEC 27001:2022 is the world's reference standard for managing information security. It defines the requirements for an Information Security Management System (ISMS) — the governance, risk and control framework an organisation uses to protect the confidentiality, integrity and availability of its information.

The 2022 revision restructures Annex A into 93 controls across four themes — organisational, people, physical and technological — and introduces attributes that make controls easier to map to other frameworks such as NIS2, DORA and the national baselines.

Annex A at a glance: 93 controls, 4 themes

A.5 — Organisational (37)

Policies, roles, supplier and incident management, threat intelligence, classification.

A.6 — People (8)

Screening, terms of employment, awareness, disciplinary process, remote working.

A.7 — Physical (14)

Secure areas, equipment, clear desk/screen, supporting utilities, cabling.

A.8 — Technological (34)

Access control, cryptography, logging, secure development, network and endpoint security.

ISO 27001:2022 Annex A controls list (all 93)

The titles of the 93 controls, by theme. Controls marked “new” did not exist in the 2013 version. The normative text of each control is in ISO/IEC 27001, and the implementation guidance in ISO/IEC 27002.

A.5 — Organizational controls (37)

  1. A.5.1Policies for information security
  2. A.5.2Information security roles and responsibilities
  3. A.5.3Segregation of duties
  4. A.5.4Management responsibilities
  5. A.5.5Contact with authorities
  6. A.5.6Contact with special interest groups
  7. A.5.7Threat intelligencenew
  8. A.5.8Information security in project management
  9. A.5.9Inventory of information and other associated assets
  10. A.5.10Acceptable use of information and other associated assets
  11. A.5.11Return of assets
  12. A.5.12Classification of information
  13. A.5.13Labelling of information
  14. A.5.14Information transfer
  15. A.5.15Access control
  16. A.5.16Identity management
  17. A.5.17Authentication information
  18. A.5.18Access rights
  19. A.5.19Information security in supplier relationships
  20. A.5.20Addressing information security within supplier agreements
  21. A.5.21Managing information security in the ICT supply chain
  22. A.5.22Monitoring, review and change management of supplier services
  23. A.5.23Information security for use of cloud servicesnew
  24. A.5.24Information security incident management planning and preparation
  25. A.5.25Assessment and decision on information security events
  26. A.5.26Response to information security incidents
  27. A.5.27Learning from information security incidents
  28. A.5.28Collection of evidence
  29. A.5.29Information security during disruption
  30. A.5.30ICT readiness for business continuitynew
  31. A.5.31Legal, statutory, regulatory and contractual requirements
  32. A.5.32Intellectual property rights
  33. A.5.33Protection of records
  34. A.5.34Privacy and protection of personal identifiable information (PII)
  35. A.5.35Independent review of information security
  36. A.5.36Compliance with policies, rules and standards for information security
  37. A.5.37Documented operating procedures

A.6 — People controls (8)

  1. A.6.1Screening
  2. A.6.2Terms and conditions of employment
  3. A.6.3Information security awareness, education and training
  4. A.6.4Disciplinary process
  5. A.6.5Responsibilities after termination or change of employment
  6. A.6.6Confidentiality or non-disclosure agreements
  7. A.6.7Remote working
  8. A.6.8Information security event reporting

A.7 — Physical controls (14)

  1. A.7.1Physical security perimeters
  2. A.7.2Physical entry
  3. A.7.3Securing offices, rooms and facilities
  4. A.7.4Physical security monitoringnew
  5. A.7.5Protecting against physical and environmental threats
  6. A.7.6Working in secure areas
  7. A.7.7Clear desk and clear screen
  8. A.7.8Equipment siting and protection
  9. A.7.9Security of assets off-premises
  10. A.7.10Storage media
  11. A.7.11Supporting utilities
  12. A.7.12Cabling security
  13. A.7.13Equipment maintenance
  14. A.7.14Secure disposal or re-use of equipment

A.8 — Technological controls (34)

  1. A.8.1User endpoint devices
  2. A.8.2Privileged access rights
  3. A.8.3Information access restriction
  4. A.8.4Access to source code
  5. A.8.5Secure authentication
  6. A.8.6Capacity management
  7. A.8.7Protection against malware
  8. A.8.8Management of technical vulnerabilities
  9. A.8.9Configuration managementnew
  10. A.8.10Information deletionnew
  11. A.8.11Data maskingnew
  12. A.8.12Data leakage preventionnew
  13. A.8.13Information backup
  14. A.8.14Redundancy of information processing facilities
  15. A.8.15Logging
  16. A.8.16Monitoring activitiesnew
  17. A.8.17Clock synchronization
  18. A.8.18Use of privileged utility programs
  19. A.8.19Installation of software on operational systems
  20. A.8.20Networks security
  21. A.8.21Security of network services
  22. A.8.22Segregation of networks
  23. A.8.23Web filteringnew
  24. A.8.24Use of cryptography
  25. A.8.25Secure development life cycle
  26. A.8.26Application security requirements
  27. A.8.27Secure system architecture and engineering principles
  28. A.8.28Secure codingnew
  29. A.8.29Security testing in development and acceptance
  30. A.8.30Outsourced development
  31. A.8.31Separation of development, test and production environments
  32. A.8.32Change management
  33. A.8.33Test information
  34. A.8.34Protection of information systems during audit testing

The 11 new controls in ISO 27001:2022

  • A.5.7Threat intelligence

    Collect and analyse information about threats so controls follow the real threat landscape.

  • A.5.23Information security for use of cloud services

    Define how cloud services are acquired, used, managed and exited.

  • A.5.30ICT readiness for business continuity

    Plan, implement and test ICT continuity against the business continuity objectives (RTO, RPO).

  • A.7.4Physical security monitoring

    Monitor premises continuously for unauthorised physical access.

  • A.8.9Configuration management

    Define, document and monitor secure configurations of hardware, software, services and networks.

  • A.8.10Information deletion

    Delete information that is no longer required, on systems, devices and storage media.

  • A.8.11Data masking

    Mask data — pseudonymise or anonymise — according to the access-control policy.

  • A.8.12Data leakage prevention

    Apply data leakage prevention to systems, networks and endpoints holding sensitive information.

  • A.8.16Monitoring activities

    Monitor networks, systems and applications for anomalous behaviour and act on it.

  • A.8.23Web filtering

    Manage access to external websites to reduce exposure to malicious content.

  • A.8.28Secure coding

    Apply secure coding principles to software development.

A.5.30 ties the ISMS directly to business continuity: the recovery objectives come from the RTO and RPO set in the BIA. That is the core of ResiPlan's business continuity software.

ISO 27001:2013 → 2022: where did A.5 to A.18 go?

The 2013 version had 114 controls in 14 domains (A.5 to A.18). The 2022 version merges them into 93 controls and 4 themes. Certificates against the 2013 version stopped being valid on 31 October 2025. For each former domain, the table shows the 2022 controls that now carry its content.

2013 domain2013 controls2022 controls
A.5Information security policies2A.5.1
A.6Organization of information security7A.5.2, A.5.3, A.5.5, A.5.6, A.5.8, A.6.7, A.8.1
A.7Human resource security6A.5.4, A.6.1, A.6.2, A.6.3, A.6.4, A.6.5
A.8Asset management10A.5.9, A.5.10, A.5.11, A.5.12, A.5.13, A.7.10
A.9Access control14A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, A.8.3, A.8.4, A.8.5, A.8.18
A.10Cryptography2A.8.24
A.11Physical and environmental security15A.7.1, A.7.2, A.7.3, A.7.5, A.7.6, A.7.7, A.7.8, A.7.9, A.7.10, A.7.11, A.7.12, A.7.13, A.7.14, A.8.1
A.12Operations security14A.5.37, A.8.6, A.8.7, A.8.8, A.8.13, A.8.15, A.8.17, A.8.19, A.8.31, A.8.32, A.8.34
A.13Communications security7A.5.14, A.6.6, A.8.20, A.8.21, A.8.22
A.14System acquisition, development and maintenance13A.5.8, A.8.25, A.8.26, A.8.27, A.8.29, A.8.30, A.8.31, A.8.32, A.8.33
A.15Supplier relationships5A.5.19, A.5.20, A.5.21, A.5.22
A.16Information security incident management7A.5.24, A.5.25, A.5.26, A.5.27, A.5.28, A.6.8
A.17Information security aspects of business continuity management4A.5.29, A.8.14
A.18Compliance8A.5.31, A.5.32, A.5.33, A.5.34, A.5.35, A.5.36

ISO 27001 with ResiPlan

ResiPlan ships the full ISO 27001:2022 Annex A catalogue. Run a maturity GAP analysis (0–4) control by control, attach evidence, and watch your Statement of Applicability and compliance score build themselves.

Thanks to correspondence tables, a rating you give in ISO 27001 carries over to NIS2, CyFun, CYRA and BIO where the correspondence is exact. DORA and the other national baselines are assessed separately.

See all 15 covered frameworksThe cross-mapping engine

Frequently asked questions

What is Annex A of ISO 27001?

Annex A is the reference list of information security controls in ISO/IEC 27001. The 2022 version holds 93 controls in four themes. An organisation does not have to apply all of them: it selects controls through risk treatment and records each decision, with its justification, in the Statement of Applicability.

How many controls are in ISO 27001:2022?

93 controls in Annex A, grouped into four themes: 37 organisational (A.5), 8 people (A.6), 14 physical (A.7) and 34 technological (A.8).

What is the Statement of Applicability (SoA)?

The SoA records which Annex A controls apply, their implementation status and the justification for any exclusion. ResiPlan generates it from your assessment.

Does ISO 27001 help with NIS2 and DORA?

Yes. ISO 27001 controls map directly to NIS2 measures and DORA's ICT-risk requirements. In ResiPlan, an ISO assessment auto-fills the equivalent NIS2 and CYRA controls via cross-mapping.

What are the new controls in ISO 27001:2022?

Eleven: A.5.7 Threat intelligence, A.5.23 Cloud services security, A.5.30 ICT readiness for business continuity, A.7.4 Physical security monitoring, A.8.9 Configuration management, A.8.10 Information deletion, A.8.11 Data masking, A.8.12 Data leakage prevention, A.8.16 Monitoring activities, A.8.23 Web filtering and A.8.28 Secure coding.

Where are A.12, A.14 and A.18 in ISO 27001:2022?

The 2013 domains no longer exist. Operations security (A.12) now sits mostly in A.8 (8.6–8.8, 8.13, 8.15, 8.17, 8.19, 8.31, 8.32, 8.34) plus A.5.37; system development (A.14) in A.8.25–8.33 and A.5.8; compliance (A.18) in A.5.31–5.36. The table on this page maps all 14 former domains.

How long does ISO 27001 certification take?

Typically 6–12 months to build and operate the ISMS before a Stage 1/Stage 2 audit. A gap analysis at the start tells you exactly how far you are.

Other frameworks

ResiPlan covers 15 frameworks. ISO 27001, NIS2, CyFun, CYRA, BIO are linked: a rating carries over where the correspondence is exact. The others are assessed separately.

NIS2DORA🇳🇱 CYRA🇧🇪 CyFun🇩🇪 BSI IT-Grundschutz🇳🇱 BIO🇫🇷 ANSSI🇪🇸 ENS🇮🇹 FNCS

Assess your ISO 27001 compliance

Run a maturity gap analysis, attach your evidence and generate a report — with cross-mapping to the other frameworks.