Search controls

Control effect

Filter by how the control works.

Preventive Detective Corrective

Domain

ISO 27001 Annex A control domains.

Organisational People Physical Technological

Topics

Cross-framework topics.

Access control Application security Asset management Assurance and audit Audit Authentication Awareness and training Backups Business continuity Cabling security Capacity management CCTV and alarms Change management Clear desk and screen Compliance Confidentiality agreements Configuration management Contracts Cryptography Data deletion Data governance Data loss prevention Employment terms Endpoints Environment separation Equipment disposal and re-use Equipment maintenance Equipment protection Hardening HR security ICT supply chain Identity & access management Incident management Independent review Information classification Information transfer Internet access IT change Joiners, movers & leavers Key management Labelling Laws and regulations Least privilege Logging and monitoring Malware protection Multi factor authentication Network security Network segmentation Off-premises assets Offboarding Physical security PII protection Policy, rules and standards compliance Privacy Privileged access Records management Redundancy Role changes Runbooks and SOPs Secure architecture Secure areas Secure coding Secure facilities Secure SDLC Security culture Security requirements Security testing Software installation Storage media Supplier management Third party risk Time synchronisation Visitor access Vulnerability management Web filtering

Clear filters

ISO 27001

ISO 27001 Annex A Controls

Browse all 93 ISO/IEC 27001:2022 Annex A controls. Each control includes plain-language guidance, implementation tips, audit evidence requirements, and cross-framework mappings to the ASD Essential Eight and ASD Information Security Manual.

Showing 93 controls.

Per page

What are ISO 27001 Annex A controls?

ISO/IEC 27001:2022 Annex A defines 93 information security controls grouped into four domains: Organisational (37 controls), People (8 controls), Physical (14 controls), and Technological (34 controls). These controls form the basis of any Statement of Applicability (SoA) and are essential for organisations building or certifying an Information Security Management System (ISMS).

Control Stack maps every Annex A control to corresponding requirements in the ASD Essential Eight and ASD Information Security Manual, so you can see how a single implementation action satisfies multiple frameworks at once.

Showing 1-20 of 93 controls

Page 1

Annex A 5.1 📘 ISO/IEC 27001:2022

Policies for information security

Have clear, approved security policies that everyone knows about and follows.

Control effect

Domain

Topics

ISO 27001 Annex A Controls

What are ISO 27001 Annex A controls?

Policies for information security

Acceptable Use Policies for Information and Assets

Return of Organisation's Assets upon Departure

Information Classification Policy and Practices

Labelling of Information

Information Transfer Policies and Procedures

Access Control Policies and Procedures

Identity life cycle management

Management of Authentication Information

Managing Access Rights to Information Assets

Managing Information Security in Supplier Relationships

Defining Information Security Roles and Responsibilities

Integrating security clauses in supplier agreements

Managing Information Security in the ICT Supply Chain

Monitoring and Managing Supplier Services

Using incidents to improve security controls

Information security incident management planning and preparation

Assessment and decision on information security events

Response to Information Security Incidents

Learning from information security incidents

Procedures for Collecting and Preserving Evidence

Maintain information security during disruptions

Segregation of Duties

ICT Readiness for Business Continuity

Compliance with Information Security Legal Requirements

Intellectual Property Rights Protection

Protection of Records

Privacy and Protection of Personally Identifiable Information

Independent review of information security

Review compliance with information security policies

Documented Operating Procedures for Information Processing

Management responsibilities for information security

Establish and Maintain Contact with Authorities

Contact with special interest groups

Threat Intelligence Collection and Analysis

Information security in project management

Inventory management of information and associated assets

Personnel Background Verification

Terms and conditions of employment for security

Information security awareness, education and training programme

Disciplinary Process for Information Security Violations

Responsibilities after employment termination or role change

Confidentiality and Non-disclosure Agreements

Remote Working Security Measures

Mechanisms for Reporting Security Events

Physical Security Perimeters

Secure Management of Storage Media

Protection from Utility Failures

Secure Cabling for Power and Data

Proper Maintenance of Equipment

Secure disposal or re-use of equipment

Physical access controls for secure areas

Physical Security for Offices and Facilities

Continuous monitoring of physical access to premises

Protecting against physical and environmental threats

Security Measures for Working in Secure Areas

Clear desk and clear screen policies

Equipment Siting and Protection

Security of Off-Site Assets

Protection of User Endpoint Devices

Secure deletion of information when no longer needed

Data Masking for Sensitive Information

Data Leakage Prevention Measures

Backup and Recovery Procedures for Data

Clock Synchronisation for Information Processing Systems

Logging of Activities and Events

Monitoring Networks and Systems for Anomalous Behaviour

Clock synchronization for information systems

Securing Software Installations on Operational Systems

Secure Software Installation Procedures

Management of Privileged Access Rights

Network and Network Devices Security

Security of Network Services

Network Segregation for Security

Web Filtering to Reduce Malicious Website Exposure