ISO 27001 organisational controls: A.5.1–A.5.37
The 37 organisational controls in Annex A section 5 address how information security is directed, coordinated and maintained across business relationships. They connect management decisions with operational responsibilities. A strong technical platform cannot compensate for unclear authority, missing supplier commitments or incident decisions nobody is assigned to make.
Follow the organisational decision chain
Policy and responsibilities establish direction and accountability. Information inventories, classification and handling arrangements help people understand what needs protection. Access governance connects business decisions with identities and technical enforcement. Supplier and cloud arrangements extend those responsibilities across external boundaries.
Incident preparation, response, learning and evidence handling serve different purposes. Continuity and recovery decisions then connect security to service needs during disruption. Obligations, records, privacy, independent review and compliance checks support accountability and assurance. The individual pages explain these distinctions rather than presenting each topic as an isolated document requirement.
Select and implement proportionately
Use risk treatment to determine necessary controls and explain Annex A exclusions. A small organisation can use straightforward arrangements where they achieve the required outcome. Larger groups may need clearer cross-entity interfaces, common methods and informed local ownership. Size alone does not establish whether a particular control is necessary.
Many organisational controls rely on several teams. Assign the business decision, operational task and review responsibility explicitly. For example, procurement can manage an agreement while a service owner evaluates operational evidence and a specialist advises on technical exposure. Avoid assuming a single supplier questionnaire performs all those functions.
Illustrative examples
A BPO onboarding a client may need contract-specific information handling, access approval and incident communication arrangements. The account team, HR, operations and IT each hold part of the process. The useful evidence follows a real case across those interfaces instead of showing four unrelated policies.
A manufacturer using remote specialist support needs to understand provider access, information exchange, continuity needs and contractual responsibilities. A supplier certificate can inform assurance, but the organisation still evaluates its relevance and operates its own decisions and controls.
What convincing evidence looks like
Look for traceable decisions and operating results: approved responsibilities, justified access decisions, managed supplier changes, exercised incident arrangements or review findings acted on. A document can describe the intended process; samples and review evidence show whether it works. Protect sensitive records when using them for customer or audit assurance.
These guides provide original practical interpretation, not legal advice or copied standard text. When obligations arise from a particular jurisdiction or contract, confirm applicability and interpretation with the responsible specialists. A control label does not create a universal retention period, notification deadline or contractual clause.
Individual controls in this theme
A.5.1 · Policies People Can Apply
Information security policies should help people make consistent decisions about protecting information. This guide explains how to connect management direction with usable topic policies, communicate changes and test understanding. Follow examples from software delivery and construction procurement, distinguish required policy outcomes from optional document structures, and plan proportionate review and implementation support.
A.5.2 · Assign Security Decisions to the Right People
Security responsibilities need to identify who decides, who performs the work and who checks the result. This guide shows how to make ownership effective across internal teams and providers, deal with absence and delegation, and test unclear handovers. Examples from managed IT and BPO services demonstrate why a named coordinator cannot own every business decision.
A.5.3 · Separate Duties That Could Conceal a Failure
Segregation of duties reduces the opportunity for one person to introduce and conceal an unauthorised action. Learn how to identify consequential conflicts, separate decisions from execution and assess compensating checks in small teams. Software release and manufacturing supplier examples show why different job titles or approval screens do not necessarily provide independent control.
A.5.4 · Make Security Part of Everyday Management
Managers influence security through the work they assign, the resources they provide and the exceptions they tolerate. This guide explains how A.5.4 connects policy with daily supervision, role preparation and a workable reporting culture. BPO and construction examples show how to resolve conflicts between delivery pressure and security responsibilities without relying on policy acknowledgements alone.
A.5.5 · Keep Authority Contacts Ready for Use
Authority contacts are useful only when the right person can reach the right organisation through a trusted route. This guide explains how to connect contacts with incident decisions, local obligations and disruption planning. Manufacturing and software examples show how to maintain usable information without treating a contact list as proof of legal compliance or an automatic reporting rule.
A.5.6 · Turn Security Community Contacts into Useful Learning
Security communities can reveal problems and practices that one organisation would otherwise discover late. This guide explains how to choose relevant groups, assign participation and turn external insight into internal action. IT-service and manufacturing examples show the value of disciplined sharing, source assessment and feedback, without making paid membership or a particular forum mandatory.
A.5.7 · Turn Threat Information into Decisions
Threat intelligence combines external and internal information with analysis of what matters to the organisation. This guide follows an alert from source assessment to a defensible action, explaining relevance, uncertainty and decision ownership. Software and manufacturing examples distinguish useful intelligence from copied feeds, and show how to connect findings with risk assessment and control testing.
A.5.8 · Build Security into Project Decisions
Project security includes both the protection of project information and the security of what the project delivers. This guide explains how to identify requirements early, revisit risks at meaningful decisions and hand over unresolved issues responsibly. Construction and BPO examples demonstrate proportionate integration into existing project methods without adding a separate security bureaucracy.
A.5.9 · Build an Inventory That Supports Security Decisions
A useful asset inventory explains what needs protection, who owns the decisions and which services depend on it. This guide goes beyond equipment lists to examine information, providers and changing technology. BPO and manufacturing examples show how to test completeness, assign meaningful ownership and maintain linked inventories without attempting to catalogue every file individually.
A.5.10 · Define Acceptable Use People Can Follow
Acceptable-use rules should explain how people may handle information and services in real work. This guide covers permitted use, practical alternatives, exceptions and the movement of copies through their lifecycle. Software and construction examples show how to address new tools and shared equipment without assuming that broad prohibitions or signed acknowledgements provide effective protection.
A.5.11 · Recover Assets When Roles or Contracts Change
Returning a laptop is only one part of recovering the organisation’s assets. This guide follows equipment, information and service responsibilities through employment changes and contract endings. Software-contractor and manufacturing examples explain reconciliation, remote returns and unresolved items, while distinguishing asset recovery from access removal and continuing confidentiality responsibilities.
A.5.12 · Classify Information by Its Protection Needs
Classification should tell people how information needs to be protected, not merely attach a confidentiality label. This guide considers integrity, availability, customer requirements and changing sensitivity. Manufacturing and software examples show how owners can choose useful categories, align handling rules and review decisions without imposing unnecessary restrictions or ignoring critical public information.
A.5.13 · Make Information Labels Useful
Information labels tell recipients how to handle information when its original context is missing. Explore how to connect labels with classification, preserve meaning across exports and physical copies, and manage technical limitations. Examples from BPO operations and construction show why readable markings and functioning handling rules must work together.
A.5.14 · Protect Information in Transfer
Information transfer needs protection from the moment material leaves one controlled setting until the intended recipient can handle it safely. This guide examines recipient checks, agreed channels, physical custody and sensitive conversations. Software and manufacturing examples show how to test the whole journey and identify gaps that encryption alone cannot resolve.
A.5.15 · Define Access Control Rules
Access control starts with a defensible decision about who or what may do which activity. This guide connects physical and logical access, information ownership, permission models and exceptions. Examples from construction and software show how to uncover paths that bypass intended restrictions and turn business requirements into testable access rules.
A.5.16 · Manage the Identity Lifecycle
Identity management links an account or other identifier to an accountable person or system throughout its useful life. This guide explains verification, sponsorship, duplicate and shared identities, external identity trust and retirement. IT and BPO examples show how identities become orphaned and how lifecycle checks expose gaps that access reviews can miss.
A.5.17 · Protect Authentication Information
Authentication information needs protection throughout issue, use, recovery and replacement. This guide explains why a strong login can still fail through a weak reset process or unmanaged service secret. BPO and software examples show how to test identity verification, delivery and compromise response without exposing actual credentials in audit evidence.
A.5.18 · Keep Access Rights Justified
Access rights should change when the business need changes. This guide covers authorised provision, meaningful reviews, temporary permissions and verified removal across physical and digital systems. Manufacturing and software examples explain accumulated privileges and incomplete revocation, helping owners assess effective access instead of approving an unfamiliar list of account names.
A.5.19 · Manage Supplier Security Risks
Supplier security depends on what a relationship exposes and what the business relies upon. This guide explains proportionate assessment, internal ownership, limited negotiating power and secure exit. Construction and BPO examples show why supplier spend and certificates alone are weak proxies for information risk, and how to connect assessment with operational decisions.
A.5.20 · Agree Supplier Security Requirements
Supplier agreements should turn identified security needs into responsibilities both parties understand. This guide explains how to make requirements testable, address incidents and changes, and plan information return at exit. Software and manufacturing examples distinguish meaningful commitments from generic assurances while keeping negotiation, operational ownership and legal review connected.
A.5.21 · Understand ICT Supply-Chain Risk
ICT supply-chain security looks beyond the direct supplier to the components, services and organisations on which delivery depends. This guide explores proportionate visibility, trustworthy acquisition, downstream requirements and component retirement. Software and manufacturing examples show how hidden dependencies affect vulnerability response, authenticity and continuity without demanding impossible knowledge of every supplier tier.
A.5.22 · Review Supplier Security as It Changes
A supplier approved last year may operate differently today. This guide explains how to evaluate service evidence, handle changes and follow through on security weaknesses. BPO and construction examples show why uptime reports and renewal questionnaires are insufficient when hosting, support or subcontracting arrangements change, and how to keep review decisions actionable.
A.5.23 · Govern Cloud Services from Start to Exit
Cloud security requires decisions throughout acquisition, use, management and exit. This guide helps cloud customers clarify shared responsibilities, assess standard terms and test whether data remains recoverable and portable. Software and construction examples show why provider assurance does not replace customer configuration, ownership or an achievable exit arrangement.
A.5.24 · Prepare for Security Incidents
Incident preparation makes the first difficult decisions possible before an event occurs. This guide explains response authority, reporting routes, unavailable systems, external coordination and realistic exercises. BPO and manufacturing examples show how to test practical readiness, expose missing dependencies and distinguish a written incident plan from a team that can use it.
A.5.25 · Assess Events and Decide on Incidents
Event assessment determines whether a reported concern needs incident handling and how urgently it should be addressed. This guide explores decision criteria, incomplete information, reassessment and traceable reasoning. IT and construction examples show why neither a technical alert score nor an initial benign explanation should replace an informed assessment of business consequences.
A.5.26 · Coordinate Incident Response
Incident response turns an assessed security concern into coordinated action under documented procedures. This guide examines containment trade-offs, communication, evidence protection and controlled recovery. Software and manufacturing examples show why restoring a service is not the same as resolving an incident, and how to preserve accountable decisions while circumstances change.
A.5.27 · Learn from Security Incidents
Incident learning should change the conditions that allowed harm or delayed response. This guide explains evidence-based analysis, recurring patterns, proportionate actions and effectiveness checks. BPO and software examples show how to move beyond blaming an individual or repeating awareness messages, while connecting lessons with risk assessment and management-system improvement.
A.5.28 · Preserve Reliable Incident Evidence
Incident evidence must remain trustworthy as it is identified, collected, transferred and preserved. This guide explains authority, competent handling, provenance and controlled access without offering forensic shortcuts. Construction and IT examples show how routine troubleshooting or delayed supplier requests can undermine later understanding, and why legal admissibility cannot be guaranteed by an ISO control.
A.5.29 · Maintain Security During Disruption
Disruption changes how people work and can weaken protections that normally seem dependable. This guide explains how to maintain appropriate security in fallback operations, authorise temporary changes and restore normal controls. BPO and construction examples show why continuity plans must address confidentiality and integrity as well as keeping work moving.
A.5.30 · Build ICT Continuity Readiness
ICT continuity readiness translates business priorities into recovery capabilities that can be demonstrated. This guide explains recovery time, recoverable data, dependencies, capacity and realistic testing. Manufacturing and software examples show why a successful backup job or available standby system is not enough to prove that priority business activities can resume.
A.5.31 · Manage Security Obligations
Security obligations need a maintained connection to the activities and controls that fulfil them. This guide explains how to identify applicable requirements, interpret changes and assign operational ownership. Software and construction examples show why a generic legal register or signed contract is insufficient when obligations never reach the people designing and operating services.
A.5.32 · Protect Intellectual Property Rights
Intellectual property controls cover both respecting others’ rights and protecting the organisation’s own material. This guide examines permitted use, acquisition, licence evidence and changing use cases. Software and manufacturing examples show how technically available material can still require an ownership or permission decision, and how to make those decisions traceable.
A.5.33 · Keep Records Protected and Usable
Records need to remain trustworthy and retrievable for the period they are required. This guide connects retention decisions with access, integrity, format readability and controlled disposal. Manufacturing and BPO examples show why keeping files is not enough when context, software or permissions no longer support reliable use of the record.
A.5.34 · Put Privacy and PII Protection into Practice
Protecting personal information requires more than a privacy notice or secure storage. This guide connects applicable privacy requirements with real information flows, responsible roles and operational safeguards. BPO and software examples show how new uses and cloud integrations can change the protection needed, while keeping legal interpretation separate from ISO certification.
A.5.35 · Make Independent Security Reviews Useful
Independent review challenges whether the organisation’s security approach remains suitable and effective. This guide explains reviewer independence, competence, useful scope and management follow-through. Software and manufacturing examples show how a review can expose assumptions that routine checks miss, without confusing an internal review, a technical test and an independent certification decision.
A.5.36 · Check Compliance with Security Rules
Regular compliance review connects approved security rules with what teams and systems actually do. This guide explains testable criteria, meaningful sampling, exception handling and verified correction. IT and BPO examples show why acknowledgements and dashboards alone are weak assurance, and how owners can distinguish an isolated deviation from an impractical or misunderstood rule.
A.5.37 · Write Operating Procedures People Can Use
Operating procedures should help competent personnel perform important work correctly, including when the usual expert is absent. This guide explains useful detail, exceptions, access and controlled updates. IT and manufacturing examples show how a procedure can fail despite looking complete, and how practical walkthroughs reveal missing dependencies and outdated assumptions.
Why organisational controls matter to the business
Most security failures that damage a business are not purely technical. They arise when nobody owns a decision, when a supplier relationship carries no clear commitments, or when an incident occurs and no one is sure who may act. The organisational controls in Annex A section 5 address exactly these gaps, which is why they affect customers, contracts and audit outcomes as much as any firewall.
For leaders, this group is where security becomes a management matter: who decides, who is told, what suppliers must do and how the organisation shows it meets its obligations. Handled well, it shortens sales security reviews, makes incidents less chaotic and gives assessors a coherent picture instead of disconnected documents. Handled poorly, strong technology can still leave the business exposed to avoidable surprises.
Frequently asked questions
Are organisational controls only policies?
No. Policies may support them, but responsibilities, decisions, operational processes and review evidence are also important. A document alone may not demonstrate the intended outcome.
Can one process support several organisational controls?
Yes. A coherent supplier or incident process can support related controls, provided each relevant purpose and responsibility is addressed clearly.
Does outsourcing remove organisational responsibility?
No. External providers can perform activities, while the organisation still needs appropriate ownership, agreements, oversight and management of relevant interfaces.
Close the gaps between governance and operations
Bring Sterling a supplier relationship, information-sharing process or governance decision that currently lacks clear ownership. We can help connect policy, authority and operating evidence across functions, including suitable workflows through Effivity ISO & GRC automation software within the agreed scope. Arrange a focused consultation.
Develop control-owner understanding through Sterling Academy’s 93 Annex A Controls training. Training and consulting support implementation; independent certification bodies decide certification outcomes.