ISO/IEC 27001:2022 Annex A for beginners

ISO/IEC 27001 has two parts that people often confuse. Clauses 4 to 10 are mandatory requirements for the management system itself: context, leadership, planning, support, operation, performance evaluation and improvement. Annex A is a reference list of security controls you choose from.

93 controls in four themes

The 2022 edition reorganised the old 114 controls in 14 domains into 93 controls in four themes:

• Organizational controls (5.1 to 5.37): policies, roles, supplier security, incident management, legal requirements.
• People controls (6.1 to 6.8): screening, awareness and training, remote working, reporting events.
• Physical controls (7.1 to 7.14): perimeters, entry, equipment, clear desk, disposal.
• Technological controls (8.1 to 8.34): access, malware, logging, backups, networks, cryptography, secure development.

The Statement of Applicability

You compare your risk treatment plan with Annex A and record every control in a Statement of Applicability (SoA): whether it applies, why, and whether it is implemented. Excluding a control is allowed when your risks justify it; the certification auditor will check that the reasoning holds.

The 11 new controls

These are the controls most often missing in organisations that moved from the 2013 edition:

• 5.7 Threat intelligence
• 5.23 Information security for use of cloud services
• 5.30 ICT readiness for business continuity
• 7.4 Physical security monitoring
• 8.9 Configuration management
• 8.10 Information deletion
• 8.11 Data masking
• 8.12 Data leakage prevention
• 8.16 Monitoring activities
• 8.23 Web filtering
• 8.28 Secure coding

Tips for first-timers

• Start with the risk assessment, not the control list. Controls exist to treat risks.
• Use ISO/IEC 27002 for implementation guidance on each control.
• Keep evidence as you go: auditors test whether controls operate, not just whether a policy exists.
• Name an owner for every applicable control.