ISO 27001 clauses, subclauses and all 93 Annex A controls

Edition and reading boundaries

The guide addresses ISO/IEC 27001:2022 and the separately published Amendment 1:2024. The amendment requires consideration of climate relevance in organisational context and recognises that relevant parties may have climate-related requirements. It does not turn an ISMS into an environmental management system. Check the current ISO publication and amendment record when establishing your reference set.

This is an original practical guide, not a replacement for an authorised copy of the standard. Paragraphs describing requirements paraphrase the referenced clauses. Implementation suggestions and hypothetical examples explain possible applications; they do not create additional ISO requirements or guarantee that one method fits every organisation.

Start with information and business dependencies

Clause 4 requires understanding the organisation's relevant circumstances, interested parties and their requirements, then determining the ISMS boundary. That boundary must consider interfaces with other organisations. A cloud supplier, outsourced support team or shared corporate service can remain a significant dependency even when its employees are outside the organisation seeking certification. Outsourcing activity does not remove the need to understand its effect on information security.

As an original practical starting point, follow one important information flow. In a hypothetical payroll processor, employee information arrives from clients, is checked by an operations team, processed in hosted systems and returned through an agreed channel. Following that flow exposes the people, platforms, locations and suppliers involved. It also helps distinguish contractual requirements from informal expectations before either is converted into a control.

Scope should be understandable to a customer as well as an auditor. A statement about a particular service should not imply that every group company, office or product is covered. Equally, a narrow description should not conceal shared administration that can affect the service. Establish the boundary through business understanding and dependencies, then test whether the description accurately communicates what the ISMS manages.

Make leadership visible through decisions

Clause 5 concerns leadership, a suitable information security policy and assigned responsibilities. Executives cannot demonstrate commitment solely by signing a document while treating security as an obstacle owned by IT. Their decisions about resources, objectives and business processes need to support the system. Someone must have authority to maintain conformity and report ISMS performance to management.

In the payroll example, a client requests a delivery arrangement that bypasses the normal secure transfer route. A functioning system makes clear who reviews the request, which information is needed and who can accept any remaining risk. Leadership becomes visible when commercial pressure is handled through an authorised decision rather than an unrecorded exception. The exact approval route is an organisational choice; the need for responsibility and effective direction is not optional.

Use risk treatment to determine necessary controls

Clause 6 requires a repeatable information security risk assessment process, treatment decisions, objectives and planned ISMS changes. Assessment considers loss of confidentiality, integrity and availability within scope. It needs criteria, identified risk owners and a method that supports consistent, valid and comparable results. A risk score is useful only if people understand what the underlying assessment means and how it informs a decision.

Controls are then determined from treatment needs and compared with Annex A to check that necessary controls have not been overlooked. Annex A is a normative annex containing 93 controls, but that does not mean every organisation must implement all 93 indiscriminately. Necessary controls can also come from other sources. The Statement of Applicability explains the selected controls, inclusion reasons, implementation status and justified exclusions from Annex A.

For example, a hypothetical hosted service provider may rely on a data-centre operator for physical protection while retaining responsibilities for supplier selection, contractual arrangements and assurance. It should examine those responsibilities before excluding a physical control merely because it owns no server room. This is a suggested reasoning exercise, not a universal inclusion decision. The appropriate answer depends on the actual boundary, risks and arrangements.

Risk owners approve the treatment plan and accept residual information security risks under clause 6.1.3. That decision should be intelligible: which risk remains, why is it acceptable and what conditions matter? A plan copied from another company may contain impressive controls yet leave these questions unanswered. Practical learning in ISMS Risk Assessment & Statement of Applicability can help teams develop the assessment-to-treatment connection.

Provide support people can actually use

Clause 7 brings resources, competence, awareness, communication and documented information together. A technically sound process can fail if the designated employee lacks access, knowledge or time. The organisation must determine necessary competence and retain appropriate evidence. Completing training is one possible contribution; it does not automatically demonstrate ability to administer a sensitive system or make a particular risk decision.

As a practical check, ask whether a remote employee can find the incident-reporting route, a substitute administrator can locate current instructions, and a supplier manager understands change communications. These checks connect learning and documentation with real responsibilities.

Operate the system as services and suppliers change

Clause 8 requires the planned processes and treatment actions to be carried out under defined criteria. It addresses changes and control of relevant externally provided processes, products and services. Risk assessments must recur at planned intervals and when significant changes are proposed or occur. Assessment and treatment results require retained documented information, rather than a one-time risk register produced only for an initial audit.

Consider a hypothetical acquisition that brings a new support platform into use. The platform may change access routes, data locations and supplier responsibilities. A useful change review connects these facts with risk assessment, control decisions, instructions and evidence. It should also address what happens if migration does not proceed as expected. Treating the acquisition as a purely commercial event can leave the ISMS describing an operating model that no longer exists.

Evaluate whether protection and governance are working

Clause 9 combines monitoring and measurement, internal audit and management review. The organisation determines what to evaluate, how and when, and who is responsible for measurement and analysis. Internal audits consider both ISO requirements and the organisation's own arrangements, with objectivity and impartiality. Management reviews use relevant changes, performance, risk and treatment information to make decisions about improvement and system changes.

An access-review completion rate can conceal superficial work. Examine whether inappropriate permissions are found and resolved, owners understand decisions and repeated weaknesses are addressed. This is suggested practice; ISO 27001 does not prescribe a universal access metric, target or timetable.

Use findings to improve the underlying system

Clause 10 distinguishes continual improvement from the response to a nonconformity. When a requirement is not met, the organisation responds to the problem and its consequences, investigates the need for action on causes and checks whether corrective action is effective. Similar weaknesses elsewhere also need consideration. Closing an action because a revised instruction exists does not demonstrate that the reason for failure has been addressed.

For a hypothetical departing employee whose account remained active, disabling the account corrects an immediate exposure. Investigation might reveal that the departure notification never reached the system owner. The improvement could involve a more reliable handover, but that conclusion should follow evidence. Further awareness training would be insufficient if the notification process remains broken. Follow-up should examine whether later departures are handled as intended.

Separate required records from useful implementation aids

The standard specifically calls for documented information in several places, including scope, policy, objectives, risk processes and results, competence evidence, evaluation results, audits, management reviews and corrective action. Each detailed guide identifies the relevant records for its clause. Other information may be necessary because of the organisation's work, complexity or obligations. A useful evidence set shows decisions and operation, not merely that a template has been populated.

Context records, responsibility maps and risk dashboards are possible aids, not universally mandated titles. Choose formats that support operation and protect sensitive information. Share evidence with customers through considered access and disclosure arrangements.

Coordinate global implementation without erasing local differences

A group can use shared methods and software while retaining informed local ownership. Common risk criteria may help comparisons across locations, but local contracts, information flows and legal obligations can affect the assessment. A global policy should therefore connect with usable local procedures and escalation routes. Translation alone does not establish that staff understand the decision they are expected to make.

Test shared processes across locations: a joiner procedure may depend on unavailable approvers, and supplier services may differ locally. Incorporate those differences into the design. Independent certification arrangements determine scope and sampling.

Why the ISO 27001 clauses and controls matter to the business

ISO/IEC 27001 gives a business a recognised way to show customers, partners and regulators that information is protected on purpose rather than by luck. The clauses describe how the organisation understands its context, leads the effort, manages risk, supports people, operates, evaluates and improves. The Annex A controls then supply the reference measures against which risk decisions are checked. For a supplier fielding frequent security questions, this reduces repeated explanations and strengthens trust. For management, it turns scattered effort into something that can be owned, measured and defended. At audit, the strength of the system shows in how clearly clauses, risks, controls and evidence connect in actual work.