The short answer
ISO 27001:2022 Annex A lists 93 information security controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. They are a reference set, not a mandatory checklist. Your risk assessment decides which apply, and your Statement of Applicability records and justifies every inclusion and exclusion.
On this page
- How many controls are in ISO 27001, and what are the four themes?
- Do you need to implement all ISO 27001 controls?
- ISO 27001 control list: all 93 Annex A controls
- What changed from ISO 27001:2013 to 2022?
- How do ISO 27001 controls map to Cyber Essentials and PCI DSS?
- Why Sovereign Secure
- Need help choosing your Annex A controls?
ISO 27001 controls are the 93 information security controls listed in Annex A of ISO/IEC 27001:2022, grouped into four themes: organisational, people, physical and technological. You do not have to implement all of them. Your risk assessment decides which you need, and your Statement of Applicability (SoA) records each decision with a reason.
Sovereign Secure Ltd is an ISO 27001-certified UK consultancy, a PCI SSC-approved Qualified Security Assessor (QSA) company and an IASME-licensed Cyber Essentials certification body. Certification audits for our ISO clients are carried out by an independent certification body, our partner MQA International.
How many controls are in ISO 27001, and what are the four themes?
Annex A has 93 controls in the 2022 edition, down from 114 in ISO 27001:2013, in four themes. The themes replaced the 14 domains of the 2013 edition (A.5 to A.18), so if someone asks for the ISO 27001 domains, they usually mean these four themes. The reduction came from merging overlapping controls, not from dropping topics, and 11 controls are new.
| Theme | Control numbers | Number of controls | What it covers |
|---|---|---|---|
| Organisational | 5.1 to 5.37 | 37 | Policies, roles, assets, access, suppliers, incidents, continuity, legal |
| People | 6.1 to 6.8 | 8 | Screening, employment terms, training, remote working |
| Physical | 7.1 to 7.14 | 14 | Premises, equipment, media and disposal |
| Technological | 8.1 to 8.34 | 34 | Endpoints, authentication, logging, networks, development |
Annex A is separate from clauses 4 to 10, which set out the management system itself and cannot be excluded. Those clauses are covered in our guide to ISO 27001 requirements.
Do you need to implement all ISO 27001 controls?
No. Clause 6.1.3 asks you to determine the controls your risk treatment needs, compare them with Annex A to make sure nothing necessary has been missed, and produce an SoA that lists the necessary controls, why each is included, whether it is implemented and why any Annex A control is excluded.
Exclusions are normal. A fully remote company may exclude some physical controls, although clear desk (7.7), off-premises assets (7.9), storage media (7.10) and secure disposal (7.14) usually still apply because staff work on laptops at home. A firm that develops no software, in-house or outsourced, may exclude secure coding (8.28) and outsourced development (8.30). Each exclusion needs a reason your risk assessment and legal or contractual obligations support; “not relevant” with no reasoning is a common audit finding. Our Statement of Applicability guide shows how to record each decision.
ISO 27001 control list: all 93 Annex A controls
Download all 93 Annex A controls (.xlsx), free. The spreadsheet is our Statement of Applicability template: every control listed with columns for your decision, its justification and whether it is implemented.
Each control below has its 2022 number and title and a one-line summary. New controls are marked (new). Jump to a theme:
| Theme | Controls | Count |
|---|---|---|
| Organisational controls | 5.1 to 5.37 | 37 |
| People controls | 6.1 to 6.8 | 8 |
| Physical controls | 7.1 to 7.14 | 14 |
| Technological controls | 8.1 to 8.34 | 34 |
Organisational controls (5.1 to 5.37)
| Control | In practice |
|---|---|
| 5.1 Policies for information security | Approved policies, communicated and reviewed; our free ISO 27001 policy templates give you a starting point |
| 5.2 Information security roles and responsibilities | Named owners for security tasks |
| 5.3 Segregation of duties | No one person controls a sensitive process end to end |
| 5.4 Management responsibilities | Managers make sure staff follow policy |
| 5.5 Contact with authorities | Know which regulators and agencies to contact |
| 5.6 Contact with special interest groups | Stay in touch with security forums |
| 5.7 Threat intelligence (new) | Gather and act on threat information |
| 5.8 Information security in project management | Build security into projects |
| 5.9 Inventory of information and other associated assets | An owned, current asset inventory |
| 5.10 Acceptable use of information and other associated assets | Rules for using assets |
| 5.11 Return of assets | Recover equipment and data from leavers |
| 5.12 Classification of information | Classify information by sensitivity |
| 5.13 Labelling of information | Label information to match its class |
| 5.14 Information transfer | Protect information in transit, by any route |
| 5.15 Access control | Access rules based on business need |
| 5.16 Identity management | Manage each identity through its life cycle |
| 5.17 Authentication information | Issue and protect passwords and secrets |
| 5.18 Access rights | Grant, review and remove access |
| 5.19 Information security in supplier relationships | Manage supplier risk |
| 5.20 Addressing information security within supplier agreements | Security terms in supplier contracts |
| 5.21 Managing information security in the ICT supply chain | Manage hardware, software and service supply risk |
| 5.22 Monitoring, review and change management of supplier services | Monitor suppliers and their changes |
| 5.23 Information security for use of cloud services (new) | Adopt, run and exit cloud services securely |
| 5.24 Information security incident management planning and preparation | Incident roles and procedures ready |
| 5.25 Assessment and decision on information security events | Decide which events are incidents |
| 5.26 Response to information security incidents | Respond as your procedure says |
| 5.27 Learning from information security incidents | Use lessons to improve controls |
| 5.28 Collection of evidence | Preserve evidence properly |
| 5.29 Information security during disruption | Keep security working during disruption |
| 5.30 ICT readiness for business continuity (new) | Plan and test ICT recovery |
| 5.31 Legal, statutory, regulatory and contractual requirements | Identify and meet obligations |
| 5.32 Intellectual property rights | Respect IP and software licences |
| 5.33 Protection of records | Protect records from loss and tampering |
| 5.34 Privacy and protection of PII | Meet data protection law, such as UK GDPR |
| 5.35 Independent review of information security | Independent review at planned intervals |
| 5.36 Compliance with policies, rules and standards for information security | Check you follow your own rules |
| 5.37 Documented operating procedures | Written procedures for key IT operations |
People controls (6.1 to 6.8)
| Control | In practice |
|---|---|
| 6.1 Screening | Background checks proportionate to the role |
| 6.2 Terms and conditions of employment | Security duties in contracts |
| 6.3 Information security awareness, education and training | Regular training, with records |
| 6.4 Disciplinary process | A formal process for policy breaches |
| 6.5 Responsibilities after termination or change of employment | Duties that continue after leaving |
| 6.6 Confidentiality or non-disclosure agreements | NDAs that match what needs protecting |
| 6.7 Remote working | Security rules for working away from the office |
| 6.8 Information security event reporting | An easy way for staff to report events |
Physical controls (7.1 to 7.14)
| Control | In practice |
|---|---|
| 7.1 Physical security perimeters | Defined perimeters around sensitive areas |
| 7.2 Physical entry | Entry controls for secure areas |
| 7.3 Securing offices, rooms and facilities | Security designed into premises |
| 7.4 Physical security monitoring (new) | Monitor premises, for example with alarms or CCTV |
| 7.5 Protecting against physical and environmental threats | Protection from fire, flood and similar threats |
| 7.6 Working in secure areas | Rules inside secure areas |
| 7.7 Clear desk and clear screen | Lock screens, put papers away |
| 7.8 Equipment siting and protection | Place and protect equipment safely |
| 7.9 Security of assets off-premises | Protect laptops and devices away from the office |
| 7.10 Storage media | Control media from purchase to disposal |
| 7.11 Supporting utilities | Protect power and cooling |
| 7.12 Cabling security | Protect power and data cables |
| 7.13 Equipment maintenance | Maintain equipment correctly |
| 7.14 Secure disposal or re-use of equipment | Wipe or destroy data first |
Technological controls (8.1 to 8.34)
| Control | In practice |
|---|---|
| 8.1 User endpoint devices | Protect laptops, phones and other endpoints |
| 8.2 Privileged access rights | Restrict and track admin access |
| 8.3 Information access restriction | Enforce the access policy on information |
| 8.4 Access to source code | Control who reads and changes code |
| 8.5 Secure authentication | Strong sign-in, such as MFA where risk needs it |
| 8.6 Capacity management | Monitor and plan capacity |
| 8.7 Protection against malware | Anti-malware plus user awareness |
| 8.8 Management of technical vulnerabilities | Find, assess and fix vulnerabilities |
| 8.9 Configuration management (new) | Set and monitor secure configurations |
| 8.10 Information deletion (new) | Delete information when no longer needed |
| 8.11 Data masking (new) | Mask sensitive data where required |
| 8.12 Data leakage prevention (new) | Detect and stop unauthorised data leaving |
| 8.13 Information backup | Back up and test restores |
| 8.14 Redundancy of information processing facilities | Enough redundancy for availability needs |
| 8.15 Logging | Record, protect and review logs |
| 8.16 Monitoring activities (new) | Watch systems for abnormal behaviour |
| 8.17 Clock synchronisation | Sync clocks to an agreed time source |
| 8.18 Use of privileged utility programs | Restrict tools that bypass controls |
| 8.19 Installation of software on operational systems | Control software on live systems |
| 8.20 Networks security | Secure and manage networks |
| 8.21 Security of network services | Set security for network services |
| 8.22 Segregation of networks | Separate networks by trust level |
| 8.23 Web filtering (new) | Block harmful websites |
| 8.24 Use of cryptography | Rules for encryption and keys |
| 8.25 Secure development life cycle | Security in the development process |
| 8.26 Application security requirements | Define security needs for applications |
| 8.27 Secure system architecture and engineering principles | Apply secure design principles |
| 8.28 Secure coding (new) | Secure coding practices |
| 8.29 Security testing in development and acceptance | Test security before release |
| 8.30 Outsourced development | Direct and check outsourced development |
| 8.31 Separation of development, test and production environments | Keep the three apart |
| 8.32 Change management | Control changes to systems |
| 8.33 Test information | Choose and protect test data |
| 8.34 Protection of information systems during audit testing | Plan audit tests so they do no harm |
For 8.8 and 8.29, auditors usually ask how you find weaknesses. Our guide to ISO 27001 penetration testing explains what evidence works. If you build software, the secure development controls 8.25 to 8.29 carry most of the extra work; our guide to ISO 27001 for startups shows what a small development team can show for each.
What changed from ISO 27001:2013 to 2022?
The 2022 edition reorganised Annex A from 114 controls in 14 domains (A.5 to A.18) into 93 controls in four themes. Every 2013 control maps to a 2022 control; ISO/IEC 27002:2022 contains the mapping table.
- 11 new controls, marked above, covering threat intelligence, cloud services, ICT continuity, physical monitoring, configuration, deletion, masking, data leakage, monitoring, web filtering and secure coding.
- Merged controls. Groups of closely related 2013 controls became single controls. For example, 5.18 Access rights combines the 2013 controls for granting, reviewing and removing access.
- Attributes. ISO/IEC 27002:2022 tags each control with five attribute types (control type, information security properties, cybersecurity concepts, operational capabilities and security domains), so you can sort controls by view. Our ISO 27002 guide explains them.
- Clause changes. Clauses 4 to 10 also changed, including a new clause 6.3 on planning changes. Amendment 1 (2024) added climate change considerations to clauses 4.1 and 4.2 but left Annex A unchanged.
The transition period for 2013 certificates ended on 31 October 2025. Certificates issued against ISO 27001:2013 are no longer valid, and every certification audit is now against the 2022 edition.
How do ISO 27001 controls map to Cyber Essentials and PCI DSS?
The overlap is large but concentrated. The five Cyber Essentials technical controls sit mainly in 8.20 and 8.22 (firewalls), 8.9 and 8.19 (secure configuration), 8.8 (security update management), 5.15 to 5.18, 8.2 and 8.5 (user access control) and 8.7 (malware protection). Each of the 12 PCI DSS v4.0.1 requirements has related Annex A controls, from network security (8.20 to 8.22) to policies and incident response (5.1, 5.24 to 5.27). For the full control-by-control tables and the evidence you can reuse, see Cyber Essentials vs ISO 27001 and PCI DSS vs ISO 27001.
The bigger difference is who sets the rule. Annex A says what to control and leaves frequency and strength to your risk assessment; Cyber Essentials and PCI DSS fix them. Where you hold more than one, set the ISO control to the strictest rule that applies to that scope and record it in your SoA.
| Annex A control | ISO 27001:2022 | Cyber Essentials | PCI DSS v4.0.1 |
|---|---|---|---|
| 8.8 Management of technical vulnerabilities | Timescales set by your risk assessment | High-risk and critical updates installed within 14 days of release | Critical-vulnerability patches within one month of release (6.3.3); internal and external vulnerability scans every three months, external ones by an Approved Scanning Vendor (11.3.1, 11.3.2); penetration tests every 12 months and after significant change (11.4.2, 11.4.3) |
| 8.5 Secure authentication | Strength matched to risk | MFA on every cloud service that offers it | MFA for all non-console access into the cardholder data environment and for remote access that could reach it (8.4.2, 8.4.3) |
| 5.18 Access rights | Reviews at intervals you set | Accounts approved before issue, removed or disabled when no longer needed | All user accounts and privileges reviewed at least every six months (7.2.4); inactive accounts removed or disabled within 90 days (8.2.6) |
| 8.15 Logging | Retention and review set by risk and law | No logging control | Security event logs reviewed at least daily (10.4.1); logs kept for 12 months, the latest three months immediately available (10.5.1) |
| 6.3 Information security awareness, education and training | Regular, with records | No training control | On hire and at least every 12 months, including phishing and social engineering (12.6.3, 12.6.3.1) |
The certificates do not substitute for each other either. An ISO 27001 certificate does not replace PCI DSS validation or Cyber Essentials certification, and neither of those shows that clauses 4 to 10 are met.
Why Sovereign Secure
- ISO 27001 certified ourselves, so we apply Annex A to our own business.
- One evidence set for several schemes. As a PCI SSC QSA company and an IASME-licensed Cyber Essentials certification body, we help you set Annex A controls that also meet the fixed PCI DSS and Cyber Essentials rules.
- Testing for 8.8 and 8.29 from the same provider: penetration testing and vulnerability scanning.
- Independent certification. We prepare you; MQA International, an independent certification body, carries out the certification audits and makes its own decisions.
- UK company since 2012, headquartered in Accrington, Lancashire (Companies House 08334453).
Need help choosing your Annex A controls?
Work through the 93 controls above against your risk assessment, check the clauses and prepare for Stage 1 and Stage 2 with our ISO 27001 checklist, or ask our ISO 27001 consultancy team to run the risk assessment and build your SoA with you. Use the enquiry form or call +44 161 523 5276.
Your next step
- ISO 27001 checklistClause-by-clause readiness and a Stage 1 and Stage 2 audit checklist, free in Excel.Get the checklist
- Statement of Applicability templateAll 93 Annex A controls in a free spreadsheet, with a worked example.Get the SoA template
- Get an ISO quoteConsultancy from an ISO 27001-certified firm, with audits through our partner certification body, MQA International.Get an ISO quote
Last reviewed October 2026 by the Sovereign Secure assessment team.
