ISO 27001 Controls: A Guide to Implementing Annex A Controls

ISO 27001 is the international standard for building an Information Security Management System (ISMS). An ISMS is the set of policies, processes, and technical controls you use to manage information security risk. The current version, ISO/IEC 27001:2022, lists 93 controls in Annex A, and you choose the ones that apply to your organization.

This guide walks you through the 93 controls, how they are grouped, how to decide which ones you actually need, and what evidence an auditor expects to see.

What are ISO 27001 controls?

ISO 27001 controls are the safeguards you implement to manage information security risks and support your ISMS. In ISO/IEC 27001:2022, Annex A references 93 controls grouped into four themes: organizational, people, physical, and technological.

You do not have to implement all 93. You select controls based on your risk assessment and risk treatment plan, then record those decisions in your Statement of Applicability. A good SoA explains which controls apply, which do not, why you made each call, and how the applicable ones are implemented.

“Our 2026 survey found that SOC 2 and ISO 27001 continue to dominate adoption, together accounting for over 85% of certifications selected. “

— The Business ROI of Compliance Report

How many ISO 27001 clauses and controls are there?

ISO 27001:2022 has 11 clauses (0–10), of which Clauses 4–10 define the ISMS requirements, supported by 93 Annex A controls. The controls are grouped into four themes: organizational, people, physical, and technological. Not all of them are IT controls. Many cover governance, people, and physical security.

You must meet the requirements in Clauses 4 through 10 to claim compliance. In practice, certification depends on satisfying every requirement across those clauses, while Annex A gives you the menu of controls you draw from to treat your specific risks.

Every organization picks the controls that apply to its risk profile. If a control does not apply, you document the reason in your SoA rather than implementing it for the sake of completeness.

ISO 27001:2022 Annex A controls: The four themes

ISO 27001:2022 organizes its 93 controls into four themes, each tied to a different area of ownership. This replaces the 14-domain structure used in the retired 2013 version. Here is what each theme covers and the evidence auditors typically look for.

1. Organizational controls: Annex A.5 (37 controls)

This is the largest theme and the administrative backbone of your ISMS. It covers governance-level measures: information security policies, roles and responsibilities, segregation of duties, supplier and cloud-service security, your access control policy, threat intelligence, and incident management planning. Most cross-functional and policy work lives here.

Evidence to prepare:

• Documented, management-approved information security policies, communicated to staff and reviewed on a set schedule
• Defined security roles, responsibilities, and reporting lines
• Vendor risk assessments and a documented supplier and third-party management policy
• An access control policy plus proof of periodic access reviews
• A threat intelligence process and a documented incident response plan

2. People controls: Annex A.6 (8 controls)

This theme covers the human side of security across the full employee lifecycle: screening and background checks, security responsibilities written into employment terms, awareness training, disciplinary processes, remote working, and confidentiality or non-disclosure agreements.

Evidence to prepare:

• Background verification records for new hires
• Signed acknowledgment of security policies and signed NDAs
• Records showing employees complete periodic security awareness training
• A defined process for securing data when people join, change roles, or leave

3. Physical controls: Annex A.7 (14 controls)

This theme protects your physical premises and equipment. It covers secure areas, physical entry controls, physical security monitoring, protection against environmental and natural threats, clear desk and clear screen, equipment security, and secure disposal of assets and media.

Evidence to prepare:

• Physical entry controls and monitoring for sensitive areas
• Endpoints configured to auto-lock after a set period of inactivity
• Secure media handling and disposal procedures

“Effectiveness is subjective but if you want to measure say technical controls, set operational KPIs. Is multi-factor enabled for all accounts? Is traffic encryption enabled? What are the training completion rates and so on? You can use automated tools to get all this information directly from APIs.”

— Fabian Weber, vCISO and ISO 27001 auditor

4. Technological controls: Annex A.8 (34 controls)

This is the largest and most technical theme, and where your IT and engineering teams focus. It covers authentication, encryption, malware protection, logging and monitoring, secure coding, configuration management, data masking, data leakage prevention, web filtering, backups, and protection during development and testing.

Evidence to prepare:

• Encryption of customer data at rest and in transit
• Malware protection on endpoints that reach production systems
• Logging, monitoring, and alerting on production assets
• Vulnerability scans, penetration tests, and a documented backup and disaster recovery process

What changed in ISO 27001:2022: the 11 new controls

The 2022 update did not just renumber things. It trimmed the count from 114 to 93 by merging overlapping controls, and it added 11 new ones to address risks that barely existed when the 2013 version was written:

• A.5.7 Threat intelligence
• A.5.23 Information security for use of cloud services
• A.5.30 ICT readiness for business continuity
• A.7.4 Physical security monitoring
• A.8.9 Configuration management
• A.8.10 Information deletion
• A.8.11 Data masking
• A.8.12 Data leakage prevention
• A.8.16 Monitoring activities
• A.8.23 Web filtering
• A.8.28 Secure coding

If you last looked at the standard before 2022, these additions are where most of your gap analysis effort will go.

The 2024 climate amendment (Amendment 1:2024)

ISO 27001 now requires you to consider climate change as part of your ISMS context. That requirement came from ISO/IEC 27001:2022/Amd 1:2024, published in February 2024, a small but mandatory update that adds two sentences to the standard:

• Clause 4.1 now requires you to determine whether climate change is a relevant issue for your ISMS.
• Clause 4.2 adds a note that interested parties, such as customers, regulators, and partners, may have climate-related requirements.

No new Annex A controls came with it. For most teams, the impact is light: you document whether climate change affects your information security (for example, extreme weather threatening a data center, or grid instability affecting uptime), and if it does, you fold it into your risk assessment. Do not over-engineer it. A documented determination that it is not a material risk is enough for many organizations. Auditors began checking for this during surveillance audits starting in mid-2024.

How to identify which ISO 27001 controls you should implement

Your risk assessment decides which controls you implement, not the Annex A list itself. The list is a menu; your risks tell you what to order. Start with a thorough ISO 27001 risk assessment that surfaces the threats most relevant to your business and informs a treatment plan built around your actual exposure rather than a checklist. From there, prioritize controls based on your specific vulnerabilities, your operating environment, and your compliance goals.

A few practical inputs help: review which assets and data need priority protection, find the gaps a control could close, and factor in the regulations your industry expects. Pull in your IT, compliance, and legal stakeholders early, since they usually spot the high-risk areas first.

Sprinto keeps all of your ISO 27001 controls audit-ready

Sprinto maps every applicable Annex A control to a risk, an owner, and daily evidence pulled from your live systems, all tracked in your Statement of Applicability. When a control drifts out of compliance, you’re alerted as it happens, so you reach your audit with proof that’s already current instead of rebuilding it.