DISC InfoSec blogISO 27001:2022 Annex A Controls Explained

Apr 02 2025

ISO 27001:2022 Annex A Controls Explained

Category: ISO 27k — disc7 @ 9:19 am

ISO 27001:2022 is the international standard for information security management systems (ISMS), providing a framework for organizations to identify and address information security risks. While clauses 4–10 outline the broader ISMS requirements, Annex A offers a detailed list of 93 security controls categorized into four themes: Organizational, People, Physical, and Technological. This structure differs from the 2013 version, which contained 114 controls across 14 domains.

The Organizational category comprises 37 controls focusing on policies, procedures, and responsibilities essential for effective information security. These include establishing an information security policy, defining management responsibilities, maintaining contact with authorities, gathering threat intelligence, classifying information, managing identity and access, and overseeing asset management.

The People category encompasses 8 controls addressing the human element of information security. Key aspects involve conducting pre-employment screening, providing staff awareness training, implementing contracts and non-disclosure agreements (NDAs), managing remote working arrangements, and establishing procedures for reporting security events.

The Physical category contains 14 controls that pertain to securing the physical environment of the ISMS. These controls cover areas such as defining security perimeters and secure areas, enforcing clear desk and screen policies, ensuring the reliability of supporting utilities, securing cabling infrastructure, and maintaining equipment properly.

The Technological category includes 34 controls related to the digital aspects of information security. This encompasses implementing malware protection, establishing backup procedures, conducting logging and monitoring activities, ensuring network security and segregation, and adhering to secure development and coding practices.

Selecting appropriate Annex A controls should be based on an organization’s specific risk assessment. After identifying relevant controls, organizations compare them against Annex A to ensure comprehensive risk coverage. Any exclusions of Annex A controls must be justified and documented in the Statement of Applicability (SoA).

The SoA is a critical document within the ISMS, listing all Annex A controls along with justifications for their inclusion or exclusion and their implementation status. It should also incorporate any additional controls from other frameworks or those developed internally. Maintaining the SoA with version control and regular reviews is essential, as it plays a significant role during certification and surveillance audits conducted by certification bodies.

Understanding the distinctions between ISO 27001’s Annex A and ISO 27002 is important. While Annex A provides a concise list of controls, ISO 27002 offers detailed implementation guidance for these controls, assisting organizations in effectively applying them within their ISMS.