How many controls does ISO 27001 Annex A have?

ISO 27001:2022 has 93 controls in Annex A, grouped into four themes: Organizational (37), People (8), Physical (14), and Technological (34). The earlier 2013 version had 114 controls across 14 domains, but that version has been retired.

Are Annex A controls mandatory?

No. You do not have to implement all 93. You select the controls that apply based on your risk assessment, and you justify any exclusions in your Statement of Applicability.

Why do the Annex A themes start at A.5?

The numbering aligns with ISO 27002, the companion standard that provides implementation guidance for each control. ISO 27002’s clauses 1 to 4 are introductory, so its controls begin at clause 5, and Annex A mirrors that by starting its first theme at A.5.

What is the ISO 27001 Annex A Statement of Applicability?

The SoA defines which of the 93 Annex A controls you will implement and how, and it documents the justification for any controls you exclude. It is one of the most scrutinized documents in a certification or surveillance audit.

How many ISO 27001 controls are there in 2026?

ISO 27001:2022, the current version, has 93 Annex A controls in four themes: Organizational (A.5, 37 controls), People (A.6, 8 controls), Physical (A.7, 14 controls), and Technological (A.8, 34 controls). There is no separate “2026 version” of the standard; the current standard is the 2022 edition plus the 2024 climate amendment. The 2013 version’s 14-domain structure (A.5-A.18) has been retired, and certificates issued against it expired after 31 October 2025.

What is the difference between ISO 27001 clauses and controls?

Clauses 4 to 10 define the mandatory requirements for establishing, running, and improving your ISMS. They are the “what” of compliance. Controls (in Annex A) are the specific safeguards you choose to treat identified risks. They are the “how.”

Does ISO 27001 cover AI tools and AI agents?

There is no separate Annex A control just for AI agents, but AI tools still affect your control selection. If employees or systems use AI that accesses company data, code, customer records, or production workflows, include them in your asset inventory, access reviews, vendor assessments, logging, and risk treatment plan. Treat an AI agent with API access like any other non-human identity: define its owner, limit its privileges, rotate credentials, monitor activity, and remove access when the use case ends. If your AI use is material or customer-facing, ISO/IEC 42001 can run alongside ISO 27001 for AI-specific governance.

Can cloud-only or remote companies exclude physical Annex A controls?

Sometimes, but not automatically. If your organization has no owned office, data center, warehouse, or physical server room, some physical controls may be marked as not applicable in the SoA with a clear justification. But you may still need evidence for endpoint security, device disposal, screen-lock settings, remote-work rules, visitor access to any shared office, or physical controls at a new location. The right answer depends on your scope, assets, people, and where information is actually accessed or stored.

Who is responsible for implementing Annex A controls?

Your infosec officer or team is responsible for implementing controls and ensuring your overall compliance with ISO 27001. But the day-to-day responsibility sits with everyone. Your employees are the first line of defense in most attacks, so control implementation is a shared effort across the company, not a single person’s job.

Author: Gowsika

Gowsika is an avid reader and storyteller who untangles the knotty world of compliance and cybersecurity with a dash of charming wit! While she’s not decoding cryptic compliance jargon, she’s oceanside, melody in ears, pondering life’s big (and small) questions. Your guide through cyber jungles, with a serene soul and a sharp pen!

Blogs, ISO 27001

ISO 27001 Controls: A Guide to Implementing Annex A Controls

TL;DR ISO 27001 is the international standard for building an Information Security Management System (ISMS). An ISMS is the set of policies, processes, and technical controls you use to manage information security risk. The current version, ISO/IEC 27001:2022, lists 93 controls in Annex A, and you choose the ones that apply to your organization. This…

HIPAA Compliance: Ensure Privacy and Security (Download Free Checklist)

Blogs, HIPAA

HIPAA Compliance: Ensure Privacy & Security (Download Free Checklist)

TL,DR: HIPAA compliance protects PHI under Privacy, Security, and Breach Notification Rules. It applies to covered entities and business associates that create, process, store, or transmit PHI. The article covers risk assessments, BAAs, training, encryption, access controls, penalties, and breach timelines. The HIPAA 1996 Act sets regulatory measures to ensure the security of sensitive patient…

Blogs, HIPAA

HIPAA Certification: Get HIPAA Certified in Week

TL;DR HIPAA certification proves training completion, helping healthcare providers show a proactive approach to protecting patient data and adding to their HIPAA documentation. Training is available through HHS, HIPAATraining.com, Accountable HQ, HIPAA Associates, Biologix Solutions, and Coursera, with many facilities and business associates also offering it internally for free. Requirements vary by role, with Covered…

Blogs, SOC 2

SOC 2 Requirements 2026: A Comprehensive Guide to Getting Compliant Quickly

TL;DR A big ticket deal seems to be progressing well. The final demo went smoothly. The prospect seems eager to sign the deal, even giving you a verbal thumbs-up pending last-minute approvals. And then, out of left field, comes an email asking you to send over your SOC 2 report. Panic sets in. Slack threads…

Types of HIPAA Rules - Benefits and Penalties with HIPAA Rules

Blogs, HIPAA

Types of HIPAA Rules – Benefits & Penalties with HIPAA Rules

TL,DR: HIPAA rules protect PHI and ePHI for covered entities and business associates. The seven areas include Privacy, Security, Breach Notification, Transactions, Enforcement, Identifiers, and Omnibus updates. The article explains who must comply, why each rule matters, benefits, and penalties. A patient’s health and financial information are sensitive. The Health Insurance Portability and Accountability Act,…

Blogs, NIST

7 Best NIST Compliance Software

TL; DR This article reviews the best NIST compliance software to help organizations implement and maintain NIST-aligned security controls, evaluating tools based on automation, continuous monitoring, risk assessment, evidence collection, and audit readiness. Best NIST Compliance Software in 2026:1. Sprinto2. AuditBoard3. Hyperproof4. Netwrix Auditor5. Drata6. RiskOptics (Reciprocity)7. OneTrust NIST isn’t your typical regulatory framework. Companies…