# ISO 27001:2022 Annex A — All 93 Controls

## Table of Contents
- [A.5 Organisational Controls (37 controls)](#a5-organisational-controls)
- [A.6 People Controls (8 controls)](#a6-people-controls)
- [A.7 Physical Controls (14 controls)](#a7-physical-controls)
- [A.8 Technological Controls (34 controls)](#a8-technological-controls)

---

## A.5 Organisational Controls

| ID | Control Name | Description |
|----|-------------|-------------|
| A.5.1 | Policies for information security | Define, approve, publish, and review IS policies |
| A.5.2 | Information security roles and responsibilities | Assign and communicate IS roles |
| A.5.3 | Segregation of duties | Separate conflicting duties to reduce fraud/error risk |
| A.5.4 | Management responsibilities | Require managers to enforce IS policies |
| A.5.5 | Contact with authorities | Maintain contacts with relevant authorities (law enforcement, regulators) |
| A.5.6 | Contact with special interest groups | Maintain contacts with security forums, professional bodies |
| A.5.7 | Threat intelligence ⭐NEW | Collect, analyse, and act on information about IS threats |
| A.5.8 | Information security in project management | Address IS in project management |
| A.5.9 | Inventory of information and other associated assets | Identify assets and assign ownership |
| A.5.10 | Acceptable use of information and other associated assets | Define rules for acceptable use of assets |
| A.5.11 | Return of assets | Ensure assets are returned upon change/termination |
| A.5.12 | Classification of information | Classify information per legal, value, and sensitivity needs |
| A.5.13 | Labelling of information | Apply labels per classification scheme |
| A.5.14 | Information transfer | Define rules and controls for transferring information |
| A.5.15 | Access control | Define and implement access control rules based on business/security needs |
| A.5.16 | Identity management | Manage full lifecycle of identities |
| A.5.17 | Authentication information | Control allocation and use of authentication info (passwords etc.) |
| A.5.18 | Access rights | Provision, review, modify, and remove access rights |
| A.5.19 | Information security in supplier relationships | Define IS requirements for supplier relationships |
| A.5.20 | Addressing information security within supplier agreements | Include IS in supplier contracts |
| A.5.21 | Managing information security in the ICT supply chain | Monitor and manage IS risks in the ICT supply chain |
| A.5.22 | Monitoring, review and change management of supplier services | Regularly review and audit supplier service delivery |
| A.5.23 | Information security for use of cloud services ⭐NEW | Manage IS for acquisition, use, and exit of cloud services |
| A.5.24 | Information security incident management planning and preparation | Plan and prepare for IS incident management |
| A.5.25 | Assessment and decision on information security events | Assess events and classify as incidents if applicable |
| A.5.26 | Response to information security incidents | Respond to incidents per documented procedures |
| A.5.27 | Learning from information security incidents | Use knowledge from incidents to improve controls |
| A.5.28 | Collection of evidence | Define procedures for identifying, collecting, and preserving evidence |
| A.5.29 | Information security during disruption ⭐NEW | Plan for maintaining IS during disruption |
| A.5.30 | ICT readiness for business continuity ⭐NEW | Plan, implement, monitor ICT continuity |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | Identify and document legal/regulatory requirements |
| A.5.32 | Intellectual property rights | Protect intellectual property per legal requirements |
| A.5.33 | Protection of records | Protect records from loss, destruction, and falsification |
| A.5.34 | Privacy and protection of PII | Protect privacy and PII per applicable legislation |
| A.5.35 | Independent review of information security | Review IS implementation and controls independently |
| A.5.36 | Compliance with policies, rules and standards | Ensure compliance with IS policies and standards |
| A.5.37 | Documented operating procedures | Document and maintain operating procedures for IS |

---

## A.6 People Controls

| ID | Control Name | Description |
|----|-------------|-------------|
| A.6.1 | Screening | Background verification checks on all candidates |
| A.6.2 | Terms and conditions of employment | Contractual IS responsibilities for employees and contractors |
| A.6.3 | Information security awareness, education and training | IS awareness and training for all personnel |
| A.6.4 | Disciplinary process | Formal process for IS policy violations |
| A.6.5 | Responsibilities after termination or change of employment | Define post-employment IS responsibilities |
| A.6.6 | Confidentiality or non-disclosure agreements | Require NDAs for personnel and contractors |
| A.6.7 | Remote working | Define IS policies for remote working |
| A.6.8 | Information security event reporting | Require personnel to report IS events |

---

## A.7 Physical Controls

| ID | Control Name | Description |
|----|-------------|-------------|
| A.7.1 | Physical security perimeters | Define and use security perimeters to protect sensitive areas |
| A.7.2 | Physical entry | Control physical access with authentication mechanisms |
| A.7.3 | Securing offices, rooms and facilities | Design and apply physical security for offices |
| A.7.4 | Physical security monitoring ⭐NEW | Continuously monitor premises for unauthorised access |
| A.7.5 | Protecting against physical and environmental threats | Protect against physical/environmental threats (fire, flood, etc.) |
| A.7.6 | Working in secure areas | Define procedures for working in secure areas |
| A.7.7 | Clear desk and clear screen | Require clear desk and clear screen policies |
| A.7.8 | Equipment siting and protection | Protect equipment from threats and environmental hazards |
| A.7.9 | Security of assets off-premises | Protect assets used off-site |
| A.7.10 | Storage media | Manage storage media through acquisition, use, transport, and disposal |
| A.7.11 | Supporting utilities | Protect equipment from power/utility failures |
| A.7.12 | Cabling security | Protect cables from interception/damage |
| A.7.13 | Equipment maintenance | Maintain equipment to ensure availability and integrity |
| A.7.14 | Secure disposal or re-use of equipment | Securely dispose of or sanitise equipment before re-use |

---

## A.8 Technological Controls

| ID | Control Name | Description |
|----|-------------|-------------|
| A.8.1 | User end point devices | Protect end-point devices with policies and controls |
| A.8.2 | Privileged access rights | Restrict, manage, and monitor privileged access |
| A.8.3 | Information access restriction | Restrict access to information per access control policy |
| A.8.4 | Access to source code | Restrict access to source code, dev tools, and software libraries |
| A.8.5 | Secure authentication | Implement secure authentication technologies and procedures |
| A.8.6 | Capacity management | Monitor and manage resource capacity (storage, compute, network) |
| A.8.7 | Protection against malware | Implement malware detection and prevention controls |
| A.8.8 | Management of technical vulnerabilities | Identify, evaluate, and remediate technical vulnerabilities |
| A.8.9 | Configuration management ⭐NEW | Define, document, implement, and monitor configurations |
| A.8.10 | Information deletion ⭐NEW | Delete information when no longer required |
| A.8.11 | Data masking ⭐NEW | Mask data in line with access control and business/legal needs |
| A.8.12 | Data leakage prevention ⭐NEW | Apply DLP controls to systems, networks, and devices |
| A.8.13 | Information backup | Maintain and test backup copies of information |
| A.8.14 | Redundancy of information processing facilities | Implement redundancy to meet availability requirements |
| A.8.15 | Logging | Produce, store, protect, and analyse event logs |
| A.8.16 | Monitoring activities ⭐NEW | Monitor networks, systems, and applications for anomalies |
| A.8.17 | Clock synchronisation | Synchronise clocks across systems to a single reference |
| A.8.18 | Use of privileged utility programs | Restrict and control use of utility programs with admin capabilities |
| A.8.19 | Installation of software on operational systems | Control software installations on operational systems |
| A.8.20 | Networks security | Secure, manage, and control networks and devices |
| A.8.21 | Security of network services | Define security requirements for all network services |
| A.8.22 | Segregation of networks | Segregate groups of services, users, and systems |
| A.8.23 | Web filtering ⭐NEW | Manage access to external websites to reduce exposure |
| A.8.24 | Use of cryptography | Define rules for use of cryptography (algorithms, key management) |
| A.8.25 | Secure development life cycle | Establish rules for secure software/system development |
| A.8.26 | Application security requirements | Identify and approve IS requirements for application development |
| A.8.27 | Secure system architecture and engineering principles | Define and apply security engineering principles |
| A.8.28 | Secure coding ⭐NEW | Apply secure coding principles to software development |
| A.8.29 | Security testing in development and acceptance | Define and perform security testing in development pipelines |
| A.8.30 | Outsourced development | Supervise and monitor outsourced software development |
| A.8.31 | Separation of development, test and production environments | Separate dev, test, and prod environments |
| A.8.32 | Change management | Manage changes to IS, systems, and processes |
| A.8.33 | Test information | Select, protect, and manage test data appropriately |
| A.8.34 | Protection of information systems during audit testing | Plan and control audit activities to minimise operational disruption |

---

⭐NEW = New control introduced in ISO 27001:2022 (not present in 2013 version)