ISO 27001:2022: the 93 Annex A controls explained simply

Annex A of ISO/IEC 27001:2022 is often the most intimidating part of the standard: 93 security controls, each with a short title and a purpose. The good news: they fall into four families that are easy to remember, and they do not all require the same effort. Here is a practical reading, without reproducing the text of the standard (protected by copyright) or of ISO/IEC 27002, which details their implementation.

How to read Annex A

Annex A is a reference list. Your risk assessment and obligations determine which controls you include; each is then listed in the Statement of Applicability (SoA) with its justification and implementation status. Since the 2022 edition, controls are grouped into four themes instead of fourteen chapters:

The transition period from the 2013 edition (114 controls) ended on 31 October 2025: every current certificate now refers to the 2022 edition.

The 37 organisational controls (A.5)

They form the backbone of the ISMS:

• governance: security policies, roles and responsibilities, segregation of duties, management responsibilities, contact with authorities and special interest groups;
• knowing your assets: inventory of information and assets, acceptable use, return of assets, classification, labelling and information transfer;
• identities and access: access control, identity management, authentication information, access rights;
• suppliers: security in supplier relationships and agreements, the ICT supply chain, monitoring of services, cloud services;
• incidents and continuity: planning, assessment, response, learning, collection of evidence, security during disruption, ICT readiness for business continuity;
• compliance: legal and contractual requirements, intellectual property, protection of records, privacy and personal data, independent reviews, documented operating procedures.

The 8 people controls (A.6)

The employee life cycle: screening, terms of employment, awareness and training, disciplinary process, responsibilities after termination, confidentiality agreements, remote working and event reporting.

The 14 physical controls (A.7)

Physical perimeters and entry, securing offices and rooms, physical security monitoring, protection against environmental threats, working in secure areas, clear desk and clear screen, equipment siting and protection, assets off-premises, storage media, supporting utilities, cabling, maintenance and secure disposal.

For an SME working remotely with hosting outsourced to a provider, several of these controls mostly rely on the provider’s guarantees: this must be justified in the SoA.

The 34 technological controls (A.8)

The most technical part: endpoint devices, privileged access, access restriction, source code, secure authentication, capacity, protection against malware, management of vulnerabilities, configuration management, information deletion and data masking, data leakage prevention, backup, redundancy, logging and monitoring, clock synchronisation, software installation, network security and segregation, web filtering, cryptography, secure development life cycle, secure coding, testing, outsourced development, separation of environments, change management and protection of systems during audit testing.

The 11 new controls of 2022

The 2022 edition merged many controls and added eleven reflecting current practice:

1. threat intelligence (A.5.7);
2. information security for use of cloud services (A.5.23);
3. ICT readiness for business continuity (A.5.30);
4. physical security monitoring (A.7.4);
5. configuration management (A.8.9);
6. information deletion (A.8.10);
7. data masking (A.8.11);
8. data leakage prevention (A.8.12);
9. monitoring activities (A.8.16);
10. web filtering (A.8.23);
11. secure coding (A.8.28).

Do you have to apply them all?

No, but every exclusion must be justified: no in-house development, no premises of your own, a risk considered irrelevant… An auditor will check that the justification holds against your scope and risk assessment. In practice, most organisations include the vast majority of the 93 controls, with proportionate levels of implementation.

Where should an SME start?

The controls that reduce risk the most for a reasonable effort:

1. inventory of assets and privileged accounts;
2. multi-factor authentication on email, remote access and administration tools;
3. regular backups, including an offline copy, with restore tests;
4. patch and vulnerability management;
5. periodic review of access rights, especially on departures;
6. staff awareness, in particular about phishing;
7. an incident management procedure;
8. security clauses in the contracts of critical suppliers.

How OK-GRC helps

In OK-GRC, each Annex A control is linked to shared controls with guidance and evidence examples. The Statement of Applicability builds up as you go, the AI assistant suggests justifications you approve, and “high-leverage” controls — those that also serve NIS2, DORA or SOC 2 — are highlighted so every effort counts several times.