Appearance
ISO/IEC 27001:2022 — Annex A
Annex A of ISO/IEC 27001:2022 is normative, and its name is Information security controls reference. In Table A.1, Annex A gives 93 information security controls in four themes. ISO/IEC 27001 gives its requirements in Clauses 4 to 10, and Annex A comes after these clauses. The organization uses Annex A in its information security risk treatment (Clause 6.1.3). The page ISO/IEC 27001 gives the structure of the standard.
The four themes
In Table A.1, ISO/IEC 27001:2022 puts the 93 Annex A controls into four themes. Each control has a number and a name.
| Theme | Controls | Number of controls |
|---|---|---|
| 5 Organizational controls | A.5.1 to A.5.37 | 37 |
| 6 People controls | A.6.1 to A.6.8 | 8 |
| 7 Physical controls | A.7.1 to A.7.14 | 14 |
| 8 Technological controls | A.8.1 to A.8.34 | 34 |
| Total | 93 |
These are the areas of the controls in each theme:
| Theme | Controls | Area |
|---|---|---|
| Organizational | A.5.1 to A.5.4 | Policies for information security, roles and responsibilities, segregation of duties, and management responsibilities |
| Organizational | A.5.5, A.5.6 | Contact with authorities and with special interest groups |
| Organizational | A.5.7 | Threat intelligence |
| Organizational | A.5.8 | Information security in project management |
| Organizational | A.5.9 to A.5.11 | Inventory of information and other associated assets, acceptable use of these assets, and return of assets |
| Organizational | A.5.12 to A.5.14 | Classification of information, labeling of information, and information transfer |
| Organizational | A.5.15 to A.5.18 | Access control, identity management, authentication information, and access rights |
| Organizational | A.5.19 to A.5.23 | Supplier relationships, supplier agreements, the ICT supply chain, supplier services, and the use of cloud services |
| Organizational | A.5.24 to A.5.28 | Information security incident management, from planning to the collection of evidence |
| Organizational | A.5.29, A.5.30 | Information security during disruption, and ICT readiness for business continuity |
| Organizational | A.5.31 to A.5.34 | Legal, statutory, regulatory, and contractual requirements, intellectual property rights, protection of records, and privacy and protection of PII |
| Organizational | A.5.35, A.5.36 | Independent review of information security, and compliance with policies, rules, and standards |
| Organizational | A.5.37 | Documented operating procedures |
| People | A.6.1, A.6.2 | Screening, and terms and conditions of employment |
| People | A.6.3 | Information security awareness, education, and training |
| People | A.6.4, A.6.5 | Disciplinary process, and responsibilities after termination or change of employment |
| People | A.6.6 | Confidentiality or non-disclosure agreements |
| People | A.6.7 | Remote working |
| People | A.6.8 | Information security event reporting |
| Physical | A.7.1 to A.7.4 | Physical security perimeters, physical entry, security of offices, rooms and facilities, and physical security monitoring |
| Physical | A.7.5, A.7.6 | Protection against physical and environmental threats, and work in secure areas |
| Physical | A.7.7 | Clear desk and clear screen |
| Physical | A.7.8 to A.7.10 | Equipment siting and protection, security of assets off-premises, and storage media |
| Physical | A.7.11 to A.7.13 | Supporting utilities, cabling security, and equipment maintenance |
| Physical | A.7.14 | Secure disposal or re-use of equipment |
| Technological | A.8.1 | User end point devices |
| Technological | A.8.2 to A.8.5 | Privileged access rights, information access restriction, access to source code, and secure authentication |
| Technological | A.8.6, A.8.7 | Capacity management, and protection against malware |
| Technological | A.8.8, A.8.9 | Management of technical vulnerabilities, and configuration management |
| Technological | A.8.10 to A.8.12 | Information deletion, data masking, and data leakage prevention |
| Technological | A.8.13, A.8.14 | Information backup, and redundancy of information processing facilities |
| Technological | A.8.15 to A.8.17 | Logging, monitoring activities, and clock synchronization |
| Technological | A.8.18, A.8.19 | Use of privileged utility programs, and installation of software on operational systems |
| Technological | A.8.20 to A.8.23 | Network security, security of network services, segregation of networks, and web filtering |
| Technological | A.8.24 | Use of cryptography |
| Technological | A.8.25 to A.8.28 | Secure development life cycle, application security requirements, secure system architecture and engineering principles, and secure coding |
| Technological | A.8.29 to A.8.31 | Security testing in development and acceptance, outsourced development, and separation of development, test, and production environments |
| Technological | A.8.32 to A.8.34 | Change management, test information, and protection of information systems during audit testing |
Access control, identity management, authentication information, and access rights (A.5.15 to A.5.18) are in the organizational theme. The technological theme has the controls for privileged access rights (A.8.2), information access restriction (A.8.3), and secure authentication (A.8.5).
The supplier controls (A.5.19 to A.5.23) apply through Clause 6.1.3, as all Annex A controls do. Clause 8.1 (operational planning and control) is a different requirement. In this clause, the organization must make sure that it controls externally provided processes, products or services. This applies to those that are “relevant” to its ISMS. Clause 8.1 is one of the requirements of Clauses 4 to 10. The page Clauses 4 to 10 gives Clause 8.1.
Annex A and ISO/IEC 27002:2022
The first part of ISO/IEC 27001:2022 Annex A, before Table A.1, gives two points about the controls in Table A.1:
- The controls come directly from ISO/IEC 27002:2022, Clauses 5 to 8, and are aligned with that standard.
- The organization must use the controls in context with Clause 6.1.3.
Annex A does not make each control necessary. In Clause 6.1.3 b, the organization determines the necessary controls. In Clause 6.1.3 c, it compares these controls with Annex A, to make sure that no necessary control is missing.
ISO/IEC 27002:2022 is edition 3, of 2022-02. Its ISO catalog page tells organizations that ISO/IEC 27002 gives guidance and “best practices” for the controls. The same page tells them that ISO/IEC 27001 gives the requirements for an ISMS. It also tells them that an organization cannot get certification to ISO/IEC 27002, but can get certification to ISO/IEC 27001.
How Annex A applies through risk treatment (Clause 6.1.3)
In ISO/IEC 27001:2022, the organization must make an information security risk treatment process and apply it (Clause 6.1.3). Annex A is part of this process. These are the steps of the process for Annex A:
- The organization selects its risk treatment options. It must take account of the results of its risk assessment when it selects them (6.1.3 a). Its risk assessment identifies risks to the information in the scope of the ISMS (6.1.2 c).
- The organization determines each control that is necessary for the treatment options that it selected (6.1.3 b). It can make new controls, or get controls from a source that it selects (NOTE 1 to 6.1.3).
- The organization compares these controls with Annex A, to make sure that no necessary control is missing (6.1.3 c). Annex A gives a set of possible controls (NOTE 2). The set is not complete, and the organization can add other controls if necessary (NOTE 3).
- The organization makes a Statement of Applicability (6.1.3 d). The page ISMS scope, Statement of Applicability, and certification gives its four contents.
Thus, Annex A is a set of possible controls for the check in 6.1.3 c, and it is not the only source of controls. No Annex A control is necessary only because it is in Annex A. The necessary controls are for the treatment options. The organization takes account of the risk assessment results when it selects these treatment options. Thus, the organization makes the Statement of Applicability after its risk assessment.
In Clause 6.1.3, the organization must also make a risk treatment plan (6.1.3 e). It must get the approval of the risk owners for the risk treatment plan and their acceptance of the residual information security risks (6.1.3 f). The page Clauses 4 to 10 gives all of Clause 6.1.3.
Justification for each exclusion
In ISO/IEC 27001:2022, the organization must give, in its Statement of Applicability, the justification for each Annex A control that it excludes (Clause 6.1.3 d). This requirement applies to each control. If the organization excludes a full theme, it must have a justification for each control in that theme. The organization can exclude only an Annex A control that is not necessary for its risk treatment options (6.1.3 b and c).
For example, an organization that uses only cloud services can think that the physical theme (A.7) does not apply to it. But some physical controls are about assets that such an organization can also have:
- A.7.7 Clear desk and clear screen
- A.7.9 Security of assets off-premises
- A.7.10 Storage media
- A.7.14 Secure disposal or re-use of equipment
The page ISMS scope, Statement of Applicability, and certification gives the four contents of the Statement of Applicability.
Annex A in Modulos
For ISO/IEC 27001, the Modulos Framework MFF-9, at the AI System level, has one Requirement for each of the four Annex A themes. MFF-9 does not replace the decisions that the organization makes in Clause 6.1.3 about the necessary controls and the Statement of Applicability. The table on Operationalizing ISO/IEC 27001 in Modulos gives the Requirement for each clause and each theme.
Where to go next
ISO/IEC 27001
The standard and its edition, its structure, certification, and its use with ISO/IEC 42001 and ISO/IEC 27701
ISMS scope, Statement of Applicability, and certification
The scope of the ISMS (Clause 4.3), the four contents of the Statement of Applicability, and the certification audit cycle
Clauses 4 to 10
The requirements of Clauses 4 to 10, with risk assessment and risk treatment
Integration with AI governance
Annex A controls and AI governance, ISO/IEC 42001, and the EU AI Act
Operationalizing in Modulos
OFF-9 and MFF-9, the set-up steps, and the Requirement table
Sources of this page
- ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, edition 3, 2022-10 (ISO catalog page). This page uses these parts of it:
- Clause 1, Clause 6.1.2 c, Clause 6.1.3 a to f with NOTE 1 to NOTE 3, and Clause 8.1.
- Annex A: the first part and Table A.1.
- ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection — Information security controls, edition 3, 2022-02 (ISO catalog page).
- ISO/IEC 42001:2023, edition 1, 2023-12: Annex A (normative).
Disclaimer
This page gives general information only. It does not replace legal help or the audit of a certification body. Compare this page with ISO/IEC 27001:2022.