ISO 27001:2022

ISO 27001 Annex A Controls - All 93 Explained

Every Annex A control from the 2022 revision, with what the control requires, what good looks like in practice, the evidence an auditor will ask for, and the template that fulfils it.

Reviewed & Verified by a Certified ISO/IEC 27001 Lead Implementer

Built for practitioners, by practitioners. Every template, control definition, and audit checklist in this directory is aligned with the latest ISO 27001:2022 standard and structured around real-world certification audit requirements.

Certified Lead Implementer

2022 Standard Aligned

Audit-Ready Materials

Organizational controls

37 controls covering governance, risk, suppliers, incident management and compliance.

Policies for information security

Information security roles and responsibilities

Segregation of duties

Management responsibilities

Contact with authorities

Contact with special interest groups

Threat intelligence

Information security in project management

Inventory of information and other associated assets

Acceptable use of information and other associated assets

Return of assets

Classification of information

Labelling of information

Information transfer

Identity management

Authentication information

Information security in supplier relationships

Addressing information security within supplier agreements

Managing information security in the ICT supply chain

Monitoring, review and change management of supplier services

Information security for use of cloud services

Information security incident management planning and preparation

Assessment and decision on information security events

Response to information security incidents

Learning from information security incidents

Collection of evidence

Information security during disruption

ICT readiness for business continuity

Legal, statutory, regulatory and contractual requirements

Intellectual property rights

Protection of records

Privacy and protection of PII

Independent review of information security

Compliance with policies, rules and standards for information security

Documented operating procedures

People controls

8 controls covering screening, employment terms, training, discipline and remote working.

Terms and conditions of employment

Information security awareness, education and training

Disciplinary process

Responsibilities after termination or change of employment

Confidentiality or non-disclosure agreements

Information security event reporting

Physical controls

14 controls covering perimeters, entry, equipment siting and environmental threats.

Physical security perimeters

Securing offices, rooms and facilities

Physical security monitoring

Protecting against physical and environmental threats

Working in secure areas

Clear desk and clear screen

Equipment siting and protection

Security of assets off-premises

Supporting utilities

Cabling security

Equipment maintenance

Secure disposal or re-use of equipment

Technological controls

34 controls covering access control, logging, networks, cryptography and secure development.

User endpoint devices

Privileged access rights

Information access restriction

Access to source code

Secure authentication

Capacity management

Protection against malware

Management of technical vulnerabilities

Configuration management

Information deletion

Data leakage prevention

Information backup

Redundancy of information processing facilities

Monitoring activities

Clock synchronization

Use of privileged utility programs

Installation of software on operational systems

Networks security

Security of network services

Segregation of networks

Use of cryptography

Secure development life cycle

Application security requirements

Secure system architecture and engineering principles

Security testing in development and acceptance

Outsourced development

Separation of development, test and production environments

Change management

Test information

Protection of information systems during audit testing

Implement all 93 controls

Assess your organisation against every Annex A control with the free Gap Analysis tool, or get auditor-ready templates for the controls that need documented policies with the Document Pack.

Try the Gap Analysis tool Browse ISO 27001 templates