ISO 27001 Annex A: all 93 controls explained
ISO 27001:2022 Annex A provides a reference set of 93 information security controls. Use it through the risk-treatment process, not as an automatic instruction to deploy every listed measure identically. This directory gives each control its own page, with original practical explanations, implementation choices, examples, evidence considerations and common failure patterns.
Understand the relationship between requirements and guidance
The requirements in clauses 4–10 establish the management system. Clause 6.1.3 requires the organisation to determine necessary controls and compare them with Annex A so that necessary controls are not overlooked.
Choose a control theme
37 organisational controls Organisational controls connect security with governance and business relationships. They include policy, responsibility, information handling, access governance, suppliers, cloud services, incidents, continuity, obligations and review.
Illustrative control combinations
A software provider introducing a cloud service may need coordinated supplier assessment, contractual arrangements, cloud governance, access decisions, secure development and monitoring. Selecting one “cloud” control does not answer every related question.
Prepare evidence that explains the implementation
Evidence can include decisions, approved arrangements, operating samples, configuration validation, exercises and review results. Choose it according to the actual control and scope.
Control category and control directory
Every control has a page. Open a category to read its introduction and the control guides beneath it.
Organisational controls
The 37 organisational controls in Annex A section 5 address how information security is directed, coordinated and maintained across business relationships. They connect management decisions with operational responsibilities.
People controls
The eight people controls in Annex A section 6 address the relationship between people and information security throughout their work. They include arrangements before and during work, when responsibilities change and when people leave.
Physical controls
The 14 physical controls in Annex A section 7 address protection of premises, equipment and media against relevant physical and environmental exposures. Physical security remains relevant when technology is outsourced: the organisation may still operate offices, use devices and records, and depend on provider facilities.
Technological controls
The 34 technological controls in Annex A section 8 address protection of information and systems across their lifecycle. They cover more than selecting products.
Understand the relationship between requirements and guidance
The requirements in clauses 4–10 establish the management system. Clause 6.1.3 requires the organisation to determine necessary controls and compare them with Annex A so that necessary controls are not overlooked. The Statement of Applicability records necessary controls, inclusion reasoning, implementation status and justified Annex A exclusions. Additional controls can be needed beyond the reference set.
ISO/IEC 27002:2022 provides implementation guidance for the controls. Its suggested techniques should not be presented as universally mandatory ISO 27001 wording. These pages distinguish the required control-selection process, the intended control outcome and practical advice. They do not reproduce the standard’s text, tables or attribute mappings and do not replace an authorised copy.
Choose a control theme
37 organisational controls
Organisational controls connect security with governance and business relationships. They include policy, responsibility, information handling, access governance, suppliers, cloud services, incidents, continuity, obligations and review. Start here when decisions fall between departments or a contract depends on arrangements that no single technical product can provide. The control pages distinguish related subjects so ownership and evidence remain clear.
8 people controls
People controls address relevant arrangements across the working relationship, including screening, employment terms, learning, discipline, changed responsibilities, confidentiality, remote work and event reporting. Use the guides to connect HR, managers and security responsibilities while considering applicable law and privacy. A signed agreement or completed course is only one part of a workable arrangement.
14 physical controls
Physical controls protect locations, equipment and media against relevant access and environmental risks. Their application depends on real premises, shared facilities, remote working and external dependencies. Owning no data centre does not automatically remove physical responsibilities. These guides help clarify boundaries, provider interfaces, equipment lifecycle and evidence that the relevant arrangements actually operate.
34 technological controls
Technological controls address protection across endpoints, identities, networks, applications, information handling and development. Read them in relation to the systems and services they support. The pages distinguish configuration from validation, monitoring from response and product capability from actual implementation. They also connect technical decisions with ownership, risk treatment and operational evidence.
Illustrative control combinations
A software provider introducing a cloud service may need coordinated supplier assessment, contractual arrangements, cloud governance, access decisions, secure development and monitoring. Selecting one “cloud” control does not answer every related question. Conversely, repeating the same evidence under several control headings does not prove that each intended outcome is achieved.
A BPO with remote staff may need people, physical and technical arrangements together. Confidentiality agreements, suitable working arrangements, controlled access and a usable reporting route serve different purposes. Staff should know what to do, while managers and technical owners maintain their own responsibilities. No single awareness module replaces all of those arrangements.
Prepare evidence that explains the implementation
Evidence can include decisions, approved arrangements, operating samples, configuration validation, exercises and review results. Choose it according to the actual control and scope. A policy demonstrates direction; a transaction or test can demonstrate operation. Vendor brochures and screenshots without context rarely establish the complete outcome.
Customer assurance should describe scope and limitations accurately. Certification is not a guarantee that incidents cannot happen, and a provider’s certificate does not automatically cover your responsibilities. Protect sensitive evidence when sharing it, using appropriate access and disclosure arrangements.
Why the Annex A controls matter to the business
Annex A is where an information security management system meets daily practice. It turns the management system's decisions about risk into specific measures across people, premises, technology and relationships with others. Used well, it prevents two common mistakes: copying a long list of measures without asking which ones the business needs, and overlooking a measure that the risks clearly call for. For the business, that means effort goes where customer information and operations are most exposed. For sales and delivery teams, it gives a shared vocabulary for answering security questionnaires. At audit, a clear link between risks, selected controls and operating evidence is the strongest indicator that the system works.
Frequently asked questions
Are all 93 Annex A controls mandatory?
Not automatically. Determine necessary controls through risk treatment, compare them with Annex A and justify exclusions in the Statement of Applicability. Other applicable obligations can also influence what is necessary.
Can we need controls that are not in Annex A?
Yes. The reference set is not exhaustive. Determine measures needed for the actual risks and requirements, even where they do not match one listed control exactly.
Does ISO 27002 provide additional certification requirements?
It provides control guidance. Do not treat every suggested implementation technique as mandatory ISO 27001 wording, although a practice may be required by another applicable obligation or your own system.
Does a control page provide a ready-made policy?
No. The pages explain decisions, implementation and evidence. Sterling can develop appropriate documentation within an agreed service based on your organisation’s actual needs.
Choose controls for the risks you actually face
Start with a discussion of your scope, risk assessment and existing controls. Sterling can help identify necessary measures, prepare a defensible Statement of Applicability and connect implementation with evidence. Discuss scoped access to Effivity ISO & GRC automation software where it supports the agreed programme. Arrange a focused consultation.
Develop control-owner understanding through Sterling Academy’s 93 Annex A Controls training. Training and consulting support implementation; independent certification bodies decide certification outcomes.