When people talk about "the ISO 27001 controls", they almost always mean Annex A. It's a list of security measures a business can use to deal with the risks it finds. The 2022 version of the standard, ISO/IEC 27001:2022, has 93 controls grouped into four themes: organisational, people, physical and technological.
This guide explains what the ISO 27001 controls are, how the four themes break down, which controls a small business will recognise straight away, and what changed from the 2013 version. It's written for business owners and managers, not auditors, so we've kept the jargon to a minimum.
What are the ISO 27001 controls?
The ISO 27001 controls are the 93 information security controls listed in Annex A of ISO/IEC 27001:2022. Each one describes a security measure, such as access control, backups or supplier security, that a business can use to reduce a specific risk. A business doesn't have to use all of them. It chooses the controls that treat the risks found in its own risk assessment.
Where do the controls sit in the standard?
ISO/IEC 27001 has two main parts. The requirements for the information security management system (ISMS) are in clauses 4 to 10, and a business must meet all of them to be certified. Annex A sits at the back of the standard and acts as a reference list of controls. The clauses tell you how to run the system. Annex A gives you the toolkit.
Do you have to implement every control?
No. ISO 27001 is risk-based. You assess your information security risks, choose the controls that treat them, and explain your choices in the Statement of Applicability. Any control you exclude has to be justified in the Statement of Applicability. Some controls won't apply to every business. A fully cloud-based business with no server room, for example, may have little use for some physical controls, as long as it can justify the decision.
How do ISO 27001 and ISO 27002 relate?
ISO/IEC 27002 is a companion standard that gives detailed guidance on each Annex A control: what it's for and how it might be implemented. You certify to ISO 27001, not ISO 27002, but many businesses use 27002 as a practical reference when putting controls in place.
Why the ISO 27001 controls matter
Every control in Annex A exists to protect the confidentiality, integrity and availability of information, often called the CIA triad. Confidentiality means only the right people can see it. Integrity means it can be trusted and hasn't been tampered with. Availability means it's there when you need it.
For a small business, the controls do three practical jobs. They lower the chance of a security incident, they help you meet legal, regulatory and contractual requirements, and they give clients and partners evidence they can trust. In tenders and supplier questionnaires, being able to show which controls you run, and why, can be a real competitive advantage.
They also support continuous improvement. Controls are reviewed through internal audits and management reviews, so weak ones get strengthened over time rather than forgotten.
The four themes of Annex A
The 93 controls in ISO 27001:2022 are grouped into four themes. The numbers matter less than the idea: security covers people, places and processes, not just technology.
Organisational controls (37)
Organisational controls are the largest group. They cover policies, roles and responsibilities, asset management, information classification, access control rules, supplier relationships, incident management, business continuity, legal and regulatory requirements and the use of cloud services. These controls set the rules everything else follows.
People controls (8)
People controls deal with the human side of security. They include screening before employment, terms and conditions of employment, security awareness and training, a disciplinary process, responsibilities after someone leaves, confidentiality agreements, remote working and reporting security events. Most security incidents involve a person somewhere, so these eight controls punch above their weight.
Physical controls (14)
Physical controls protect places and equipment. They cover secure areas and entry controls, physical security monitoring, protection against environmental threats, clear desk and clear screen, equipment siting and protection, storage media, supporting utilities, cabling security, equipment maintenance and the secure disposal or reuse of equipment.
Technological controls (34)
Technological controls are the ones IT teams deal with every day. They include user endpoint devices, privileged access rights, authentication, malware protection, management of technical vulnerabilities, configuration management, information deletion, data masking, data leakage prevention, backups, logging, monitoring activities, network security, web filtering, cryptography and secure coding.
ISO 27001 controls a small business will recognise
You don't need to be an IT specialist to understand most of Annex A. Here are some of the ISO 27001 controls small businesses usually deal with first, and what they look like in practice.
Access control and authentication
Who can get into which systems, and how do they prove it's really them? In practice, that means named user accounts, the least access each person needs, multi-factor authentication on email and other important systems, and removing access promptly when someone leaves. For a dental practice in Chatswood, it might be as simple as making sure the receptionist can't reach the accounts folder.
Privileged access rights
Administrator accounts can change anything, so they're a favourite target. This control means keeping admin rights to the people who genuinely need them, using separate admin accounts and reviewing who has them regularly.
Protection against malware
Endpoint protection on every laptop, desktop and server, kept up to date and monitored. It's one of the oldest controls in information security, and still one of the most important.
Management of technical vulnerabilities
Patching operating systems and applications on a schedule, and acting quickly when a serious vulnerability is announced. It also means knowing which devices and software you actually have, because you can't patch what you don't know about.
Information backup
Regular backups of important information, stored safely and separately from your live systems, with restores actually tested. A backup that's never been restored is a hope, not a control.
Supplier relationships
Knowing which suppliers can reach your systems and data, setting security requirements in your agreements and checking they're met. Your IT provider, your accounting software and your cloud storage provider are all suppliers in this sense.
Information security awareness and training
Making sure staff can spot a phishing email, know how to handle sensitive information and know who to tell when something looks wrong. Short, regular training tends to work better than one long session a year.
Incident management
Having a plan for when something goes wrong: who does what, who needs to be told and how lessons are captured afterwards. A small business doesn't need a thick manual. It needs a clear, tested process people know about.
What is the Statement of Applicability?
The Statement of Applicability (SoA) is a document that lists every Annex A control, says whether it applies to your business, explains why or why not, and records whether it's been implemented. It's one of the first documents an auditor asks for, because it connects your risk assessment to the controls you actually run.
How do you write a Statement of Applicability?
Start with your risk assessment. For each risk, note which controls treat it. Then work through all 93 Annex A controls and mark each one as applicable or not, with a short justification. Finally, record the implementation status of each applicable control. Keep it honest and current. An SoA that doesn't match reality is a common source of audit findings.
Can you add controls that aren't in Annex A?
Yes. Annex A isn't the only source of controls. If your risk assessment shows you need something extra, perhaps a control required by a client contract or an industry framework, you can add it. The Statement of Applicability should still compare your controls against the full Annex A list.
What changed from the 2013 version?
ISO/IEC 27001:2013 had 114 controls across 14 domains. The 2022 version restructured them into 93 controls across four themes. Most of the change is consolidation, where related controls were merged, but 11 controls are completely new.
The 11 new controls in ISO 27001:2022
- Threat intelligence
- Information security for use of cloud services
- ICT readiness for business continuity
- Physical security monitoring
- Configuration management
- Information deletion
- Data masking
- Data leakage prevention
- Monitoring activities
- Web filtering
- Secure coding
Looking at that list, you can see where the standard was catching up. Cloud services, configuration, data leakage and web filtering are everyday concerns for small businesses now in a way they weren't a decade ago.
Do businesses still certify to the 2013 version?
No. The transition period from the 2013 version ended on 31 October 2025. Certificates now need to be to ISO/IEC 27001:2022, so any business working towards certification should be using the 93-control structure.
All 93 ISO 27001 controls, one by one
Here's the full list of Annex A controls in ISO/IEC 27001:2022, with a plain-English note on what each one means for a small business. The numbering follows the standard: section 5 is organisational, 6 is people, 7 is physical and 8 is technological.
The 37 organisational controls (5.1 to 5.37)
5.1 Policies for information security
A set of approved information security policies that staff know about and that get reviewed regularly. For most small businesses this starts with one clear, readable top-level policy.
5.2 Information security roles and responsibilities
Who is responsible for what. Someone needs to own the ISMS, and people need to know who to go to.
5.3 Segregation of duties
Splitting conflicting tasks between different people, so one person can't, for example, both create and approve a payment.
5.4 Management responsibilities
Managers are expected to make sure their teams actually follow the security policies, not just sign them.
5.5 Contact with authorities
Knowing which authorities to contact, and when, if an incident happens.
5.6 Contact with special interest groups
Staying connected with professional bodies, security forums and industry groups that share useful security news.
5.7 Threat intelligence
Collecting and using information about current threats, so your defences reflect what attackers are actually doing. New in 2022.
5.8 Information security in project management
Thinking about security at the start of projects, such as a new system rollout, rather than bolting it on at the end.
5.9 Inventory of information and other associated assets
A register of your information, devices, systems and software, each with an owner. You can't protect what you don't know you have.
5.10 Acceptable use of information and other associated assets
Rules for how staff may use company devices, data and systems.
5.11 Return of assets
Getting laptops, phones, keys and access cards back when someone leaves.
5.12 Classification of information
Labelling information by sensitivity, for example public, internal and confidential, so people know how to handle it.
5.13 Labelling of information
Actually marking documents and data with their classification, in a way that suits your systems.
5.14 Information transfer
Rules for sending information outside the business, whether by email, file sharing or on physical media.
5.15 Access control
An access control policy setting out who can access what, based on business need and least privilege.
5.16 Identity management
Managing user identities through their whole life: creation, changes and removal.
5.17 Authentication information
How passwords and other secret authentication information are issued, protected and changed.
5.18 Access rights
Granting, reviewing and removing access rights, with regular reviews to catch access people no longer need.
5.19 Information security in supplier relationships
Managing the security risks that come with suppliers, especially those with access to your systems.
5.20 Addressing information security within supplier agreements
Putting security requirements into supplier agreements, so expectations are written down.
5.21 Managing information security in the ICT supply chain
Considering the security of the technology products and services you buy, and their own suppliers.
5.22 Monitoring, review and change management of supplier services
Checking that suppliers keep meeting your security requirements, and managing changes to their services.
5.23 Information security for use of cloud services
Rules for choosing, using and leaving cloud services such as Microsoft 365 or cloud accounting software. New in 2022.
5.24 Information security incident management planning and preparation
Having an incident response plan, with roles and steps agreed before anything goes wrong.
5.25 Assessment and decision on information security events
Deciding quickly whether a security event is a real incident that needs a response.
5.26 Response to information security incidents
Responding to incidents according to your documented procedures.
5.27 Learning from information security incidents
Reviewing incidents afterwards and using the lessons to strengthen controls.
5.28 Collection of evidence
Preserving evidence properly when an incident may lead to legal or disciplinary action.
5.29 Information security during disruption
Keeping information protected during a disruption, not just keeping the business running.
5.30 ICT readiness for business continuity
Making sure your IT can recover in line with your business continuity needs. New in 2022.
5.31 Legal, statutory, regulatory and contractual requirements
Identifying the laws, regulations and contracts that affect your information security, and meeting them.
5.32 Intellectual property rights
Protecting intellectual property, including making sure software is properly licensed.
5.33 Protection of records
Keeping records safe from loss, tampering and unauthorised access for as long as you need them.
5.34 Privacy and protection of PII
Protecting personal information in line with privacy law and your obligations to clients and staff.
5.35 Independent review of information security
Having your approach reviewed independently from time to time, for example by an internal auditor who isn't responsible for the area.
5.36 Compliance with policies, rules and standards for information security
Checking that people and systems actually follow your security policies.
5.37 Documented operating procedures
Writing down how important IT and security tasks are done, so they're done consistently.
The 8 people controls (6.1 to 6.8)
6.1 Screening
Background checks on candidates, in proportion to the role and the information they'll access.
6.2 Terms and conditions of employment
Employment contracts that spell out staff security responsibilities.
6.3 Information security awareness, education and training
Regular security awareness training, so staff can recognise phishing and handle information properly.
6.4 Disciplinary process
A formal process for dealing with security policy breaches.
6.5 Responsibilities after termination or change of employment
Making sure security duties, such as confidentiality, continue after someone leaves or changes role.
6.6 Confidentiality or non-disclosure agreements
Non-disclosure agreements with staff, contractors and others who handle sensitive information.
6.7 Remote working
Security rules for working from home, client sites or a café.
6.8 Information security event reporting
An easy way for staff to report anything suspicious, and encouragement to use it.
The 14 physical controls (7.1 to 7.14)
7.1 Physical security perimeters
Defining the physical boundaries that protect areas holding sensitive information and equipment.
7.2 Physical entry
Controlling who can get into the office and secure areas, for example with swipe cards or locks.
7.3 Securing offices, rooms and facilities
Protecting offices and rooms in line with what's inside them.
7.4 Physical security monitoring
Monitoring premises for unauthorised physical access, for example with alarms or CCTV. New in 2022.
7.5 Protecting against physical and environmental threats
Planning for fire, flood, power problems and other environmental risks.
7.6 Working in secure areas
Rules for how people behave and work in secure areas such as a comms room.
7.7 Clear desk and clear screen
Locking screens and not leaving sensitive papers out on desks.
7.8 Equipment siting and protection
Placing equipment where it's protected from damage, theft and prying eyes.
7.9 Security of assets off-premises
Protecting laptops and phones that leave the office.
7.10 Storage media
Managing USB drives, external disks and other storage media through their whole life.
7.11 Supporting utilities
Protecting equipment from power failures and other utility problems, for example with a UPS.
7.12 Cabling security
Protecting power and network cabling from damage and interception.
7.13 Equipment maintenance
Maintaining equipment properly so it stays available and secure.
7.14 Secure disposal or re-use of equipment
Wiping or destroying data before equipment is disposed of or reused.
The 34 technological controls (8.1 to 8.34)
8.1 User endpoint devices
Securing laptops, desktops, tablets and phones, usually through central device management.
8.2 Privileged access rights
Restricting and controlling administrator rights.
8.3 Information access restriction
Limiting access to information in line with your access control policy.
8.4 Access to source code
Controlling who can read and change source code, for businesses that develop software.
8.5 Secure authentication
Strong authentication, such as multi-factor authentication, for systems and applications.
8.6 Capacity management
Monitoring and planning capacity so systems don't fail under load.
8.7 Protection against malware
Endpoint protection and user awareness to defend against malware.
8.8 Management of technical vulnerabilities
Finding and fixing technical vulnerabilities, mostly through regular patching.
8.9 Configuration management
Setting secure configurations for hardware, software and networks, and keeping them that way. New in 2022.
8.10 Information deletion
Deleting information when it's no longer needed. New in 2022.
8.11 Data masking
Hiding sensitive data, such as personal details, where people don't need to see it in full. New in 2022.
8.12 Data leakage prevention
Measures to detect and stop sensitive information leaving the business without permission. New in 2022.
8.13 Information backup
Regular backups of information, software and systems, with restores tested.
8.14 Redundancy of information processing facilities
Building in enough redundancy that a single failure doesn't take critical systems down.
8.15 Logging
Recording important activity, exceptions and security events in logs that are protected and reviewed.
8.16 Monitoring activities
Watching networks, systems and applications for unusual behaviour. New in 2022.
8.17 Clock synchronisation
Keeping system clocks in sync, so logs can be matched up during an investigation.
8.18 Use of privileged utility programs
Restricting tools that can override system and application controls.
8.19 Installation of software on operational systems
Controlling what software can be installed on live systems.
8.20 Networks security
Securing and managing networks to protect information in systems and applications.
8.21 Security of network services
Setting security requirements for network services, including those from providers.
8.22 Segregation of networks
Separating networks, for example keeping guest Wi-Fi apart from the business network.
8.23 Web filtering
Blocking access to malicious or inappropriate websites. New in 2022.
8.24 Use of cryptography
Rules for using encryption and managing encryption keys.
8.25 Secure development life cycle
Building security into the way software and systems are developed.
8.26 Application security requirements
Defining security requirements when building or buying applications.
8.27 Secure system architecture and engineering principles
Applying secure design principles to systems.
8.28 Secure coding
Following secure coding practices in software development. New in 2022.
8.29 Security testing in development and acceptance
Testing security before new or changed systems go live.
8.30 Outsourced development
Overseeing the security of development work done by outside parties.
8.31 Separation of development, test and production environments
Keeping development and testing apart from live systems.
8.32 Change management
Controlling changes to systems so they don't introduce security problems.
8.33 Test information
Protecting any information used for testing, especially real data.
8.34 Protection of information systems during audit testing
Planning audit tests so they don't disrupt or damage live systems.
How the controls fit with the Essential Eight
Australian businesses often ask how Annex A relates to the Essential Eight from the Australian Signals Directorate. The short answer is that they overlap well. Essential Eight strategies like multi-factor authentication, patching applications and operating systems, restricting administrative privileges and regular backups map onto Annex A controls for authentication, vulnerability management, privileged access and backup.
That means the Essential Eight can serve as a practical technical baseline inside an ISO 27001 ISMS. Work done for one counts towards the other. We explain the differences in more detail in ISO 27001 vs the Essential Eight.
How to start working on the controls
If you're new to ISO 27001, don't start with the controls. Start with the risk assessment, because that's what tells you which controls matter for your business. Then compare what you already have against Annex A in a gap analysis. Most small businesses find they're further along on technical controls than on documentation and evidence.
Where Static Computers can help
Static Computers is an ISO 27001 certified Sydney managed IT provider, founded in 2006. We help businesses prepare for certification with a gap analysis, technical controls, policies and evidence, and support with tenders and supplier questionnaires. We don't certify anyone ourselves: that's always done by an independent, accredited certification body.
Frequently asked questions
How many controls are in ISO 27001?
ISO/IEC 27001:2022 has 93 controls in Annex A, grouped into four themes: 37 organisational, 8 people, 14 physical and 34 technological.
How many controls did ISO 27001:2013 have?
The 2013 version had 114 controls in 14 domains. The 2022 version consolidated these into 93 controls and added 11 new ones.
Are all 93 controls mandatory?
No. A business selects the controls that treat its risks and justifies any exclusions in the Statement of Applicability. What's mandatory is meeting the requirements in clauses 4 to 10.
Which ISO 27001 controls should a small business focus on first?
Usually the ones that stop the most common attacks: access control and multi-factor authentication, privileged access, malware protection, patching, backups and staff awareness. But your risk assessment should make the final call.
Next steps
For the full picture of how certification works, read our guide to ISO 27001 certification for Australian businesses. If you'd like to know which controls your business already has in place, book a complimentary IT review and we'll walk you through where you stand.