ISO 27001 Annex A Controls

Tips and tutorials on how to implement the ISO27001:2022 ANNEX A CONTROLS – Control by Control.

ISO 27001 Annex A 8.34 Protection of information systems during audit testing

ISO 27001 Annex A 8.34 Protection of Information Systems During Audit Testing Explained

ISO 27001 Annex A 8.33 Test Information

ISO 27001 Annex A 8.33 Test Information Explained

ISO 27001 Annex A 8.32 Change Management

ISO 27001 Annex A 8.32 Change Management Explained

ISO 27001 Annex A 8.31 Separation of Development, Test and Production Environments

ISO 27001 Annex A 8.31 Separation of Development, Test and Production Environments Explained

ISO 27001 Annex A 8.30 Outsourced Development

ISO 27001 Annex A 8.30 Outsourced Development Explained

ISO 27001 Annex A 8.29 Security Testing in Development and Acceptance

ISO 27001 Annex A 8.29 Security Testing in Development and Acceptance Explained

ISO 27001 Annex A 8.28 Secure Coding

ISO 27001 Annex A 8.28 Secure Coding Explained

ISO 27001 Annex A 8.27 Secure Systems Architecture and Engineering Principles

ISO 27001 Annex A 8.27 Secure Systems Architecture and Engineering Principles Explained

ISO 27001 Annex A 8.26 Application Security Requirements

ISO 27001 Annex A 8.26 Application Security Requirements Explained

ISO 27001 Annex A 8.25 Secure Development Life Cycle

ISO 27001 Annex A 8.25 Secure Development Life Cycle Explained

ISO 27001 Annex A 8.24 Use of Cryptography

ISO 27001 Annex A 8.24 Use of Cryptography Explained

ISO 27001 Annex A 8.23 Web Filtering

ISO 27001 Annex A 8.23 Web Filtering Explained

ISO 27001 Annex A 8.22 Segregation of Networks

ISO 27001 Annex A 8.22 Segregation of Networks Explained

ISO 27001 Annex A 8.21 Security of Network Services

ISO 27001 Annex A 8.21 Security of Network Services Explained

ISO 27001 Annex A 8.20 Network Security

ISO 27001 Annex A 8.20 Networks Security Explained

ISO 27001 Annex A 8.19 Installation of Software on Operational Systems

ISO 27001 Annex A 8.19 Installation of Software on Operational Systems Explained

ISO 27001 Annex A 8.18 Use of Privileged Utility Programs

ISO 27001 Annex A 8.18 Use of Privileged Utility Programs Explained

ISO 27001 Annex A 8.17 Clock Synchronisation

ISO 27001 Annex A 8.17 Clock Synchronisation Explained

ISO 27001 Annex A 8.16 Monitoring Activities

ISO 27001 Annex A 8.16 Monitoring Activities Explained

ISO 27001 Annex A 8.15 Logging

ISO 27001 Annex A 8.15 Logging Explained

ISO 27001 Annex A 8.14 Redundancy of Information Processing Facilities

ISO 27001 Annex A 8.14 Redundancy of Information Processing Facilities Explained

ISO 27001 Annex A 8.13 Information Backup

ISO 27001 Annex A 8.13 Information Backup Explained

ISO27001 Annex A Controls List

ISO 27001 Annex A Controls List

ISO 27001 Annex A 8.12 Data Leakage Prevention

ISO 27001 Annex A 8.12 Data Leakage Prevention Explained

ISO 27001 Annex A 8.11 Data Masking

ISO 27001 Annex A 8.11 Data Masking Explained

ISO 27001 Annex A 8.10 Information Deletion

ISO 27001 Annex A 8.10 Information Deletion Explained

ISO 27001 Annex A 8.9 Configuration Management

ISO 27001 Annex A 8.9 Configuration Management Explained

ISO 27001 Annex A 8.8 Management of Technical Vulnerabilities

ISO 27001 Annex A 8.8 Management of Technical Vulnerabilities Explained

ISO 27001 Annex A 8.7 Protection Against Malware

ISO 27001 Annex A 8.7 Protection Against Malware Explained

ISO 27001 Annex A 8.6 Capacity Management

ISO 27001 Annex A 8.6 Capacity Management Explained

ISO 27001 Annex A 8.5 Secure Authentication

ISO 27001 Annex A 8.5 Secure Authentication Explained

ISO 27001 Annex A 8.4 Access To Source Code

ISO 27001 Annex A 8.4 Access to Source Code Explained

ISO 27001 Annex A 8.3 Information Access Restriction

ISO 27001 Annex A 8.3 Information Access Restriction Explained

ISO 27001 Annex A 8.2 Privileged Access Rights

ISO 27001 Annex A 8.2 Privileged Access Rights Explained

ISO 27001 Annex A 8.1 User Endpoint Devices

ISO 27001 Annex A 8.1 User Endpoint Devices Explained

ISO 27001 Annex A 7.14 Secure Disposal or Re-Use of Equipment

ISO 27001 Annex A 7.14 Secure Disposal or Re-use of Equipment Explained

ISO 27001 Annex A 7.13 Equipment Maintenance

ISO 27001 Annex A 7.13 Equipment Maintenance Explained

ISO 27001 Annex A 7.12 Cabling Security

ISO 27001 Annex A 7.12 Cabling Security Explained

ISO 27001 Annex A 7.11 Supporting Utilities

ISO 27001 Annex A 7.11 Supporting Utilities Explained

ISO 27001 Annex A 7.10 Storage media

ISO 27001 Annex A 7.10 Storage Media Explained

ISO 27001 Annex A 7.9 Security of assets off-premises

ISO 27001 Annex A 7.9 Security of Assets Off-Premises Explained

ISO 27001 Annex A 7.8 Equipment siting and protection

ISO 27001 Annex A 7.8 Equipment Siting and Protection Explained

ISO 27001 Annex A 7.6 Working in secure areas

ISO 27001 Annex A 7.6 Working in Secure Areas Explained

ISO 27001 Annex A 7.7 Clear desk and clear screen

ISO 27001 Annex A 7.7 Clear Desk and Clear Screen Explained

ISO 27001 Annex A 7.5 Protecting against physical and environmental threats

ISO 27001 Annex A 7.5 Protecting Against Physical and Environmental Threats Explained

ISO 27001 Annex A 7.4 Physical security monitoring

ISO 27001 Annex A 7.4 Physical Security Monitoring Explained

ISO 27001 Annex A 7.3 Securing offices, rooms and facilities

ISO 27001 Annex A 7.3 Securing Offices, Rooms and Facilities Explained

ISO 27001 Annex A 7.2 Physical entry controls

ISO 27001 Annex A 7.2 Physical Entry Explained

ISO 27001 Annex A 7.1 Physical security perimeter

ISO 27001 Annex A 7.1 Physical Security Perimeters Explained

ISO 27001 Annex A 6.8 Information security event reporting

ISO 27001 Annex A 6.8 Information Security Event Reporting Explained

ISO 27001 Annex A 6.7 Remote working

ISO 27001 Annex A 6.7 Remote Working Explained

ISO 27001 Annex A 6.6 Confidentiality or non-disclosure agreements

ISO 27001 Annex A 6.6 Confidentiality or Non-disclosure Agreements Explained

ISO 27001 Annex A 6.5 Responsibilities after termination or change of employment

ISO 27001 Annex A 6.5 Responsibilities After Termination or Change of Employment Explained

ISO 27001 Annex A 6.4 Disciplinary process

ISO 27001 Annex A 6.4 Disciplinary Process Explained

ISO 27001 Annex A 6.3 Information security awareness, education and training

ISO 27001 Annex A 6.3 Information Security Awareness Explained

ISO 27001 Annex A 6.2 Terms and conditions of employment

ISO 27001 Annex A 6.2 Terms of Employment Explained

ISO 27001 Annex A 6.1 Screening

ISO 27001 Annex A 6.1 Screening Explained

ISO 27001 Annex A 5.37 Documented operating procedures

ISO 27001 Annex A 5.37 Documented Operating Procedures Explained

ISO 27001 Annex A 5.36 Compliance with policies and standards for information security

ISO 27001 Annex A 5.36 Compliance with Policies, Rules, and Standards Explained

ISO 27001 Annex A 5.35 Independent review of information security

ISO 27001 Annex A 5.35 Independent Review of Information Security Explained

ISO 27001 Annex A 5.34 Privacy and protection of PII

ISO 27001 Annex A 5.34 Privacy and Protection of PII Explained

ISO 27001 Annex A 5.33 Protection of records

ISO 27001 Annex A 5.33 Protection of Records Explained

ISO 27001 Annex A 5.32 Intellectual property rights

ISO 27001 Annex A 5.32 Intellectual Property Rights Explained

ISO 27001 Annex A 5.31 Identification of legal, statutory, regulatory and contractual requirements

ISO 27001 Annex A 5.31 Legal, Statutory, Regulatory and Contractual Requirements Explained

ISO 27001 Annex A 5.30 ICT readiness for business continuity

ISO 27001 Annex A 5.30 ICT Readiness for Business Continuity Explained

ISO 27001 Annex A 5.29 Information security during disruption

ISO 27001 Annex A 5.29 Information Security During Disruption Explained

ISO 27001 Annex A 5.28 Collection of evidence

ISO 27001 Annex A 5.28 Collection of Evidence Explained

ISO 27001 Annex A 5.27 Learning from information security incidents

ISO 27001 Annex A 5.27 Learning From Information Security Incidents Explained

ISO 27001:2022 Annex A 5.26 Response to information security incidents

ISO 27001 Annex A 5.26 Response to Information Security Incidents Explained

ISO 27001 Annex A 5.25 Assessment and decision on information security events

ISO 27001 Annex A 5.25 Assessment and Decision on Information Security Events Explained

ISO 27001:2022 Annex A 5.24 Information security incident management planning and preparation

ISO 27001 Annex A 5.24 Information Security Incident Management Planning and Preparation Explained

ISO 27001 Annex A 5.23 Information security for use of cloud services

ISO 27001 Annex A 5.23 Information Security for Use of Cloud Services Explained

ISO 27001 Annex A 5.22 Monitoring, review and change management of supplier services

ISO 27001 Annex A 5.22 Monitoring, Review and Change Management of Supplier Services Explained

ISO 27001:2022 Annex A 5.21 Managing information security in the ICT supply chain

ISO 27001 Annex A 5.21 Managing Information Security in the ICT Supply Chain Explained

ISO 27001 Annex A 5.20 Addressing information security within supplier agreements

ISO 27001 Annex A 5.20 Addressing Information Security Within Supplier Agreements Explained

ISO 27001 Annex A 5.19 Information security in supplier relationships

ISO 27001 Annex A 5.19 Information Security in Supplier Relationships Explained

ISO 27001 Annex A 5.18 Access rights

ISO 27001 Annex A 5.18 Access Rights Explained

ISO 27001 Annex A 5.17 Authentication information

ISO 27001 Annex A 5.17 Authentication Information Explained

ISO 27001 Annex A 5.16 Identity management

ISO 27001 Annex A 5.16 Identity Management Explained

ISO 27001 Annex A 5.15 Access control

ISO 27001 Annex A 5.15 Access Control Explained

ISO 27001 Annex A Controls Ultimate Guide

ISO 27001:2022 Annex A Controls Reference Guide

ISO 27001 Annex A 5.14 Information transfer

ISO 27001 Annex A 5.14 Information Transfer Explained

ISO 27001 Annex A 5.13 Labelling of information

ISO 27001 Annex A 5.13 Information Labelling Explained

ISO 27001 Annex A 5.12 Classification of information

ISO 27001 Annex A 5.12 Classification of Information Explained

ISO 27001 Annex A 5.11 Return of assets

ISO 27001 Annex A 5.11 Return of Assets Explained

ISO 27001 Annex A 5.10 Acceptable use of information and other associated assets

ISO 27001 Annex A 5.10 Acceptable Use of Information and Other Associated Assets Explained

ISO 27001 Annex A 5.9 Inventory of information and other associated assets

ISO 27001 Annex A 5.9 Inventory of Information and Other Associated Assets Explained

ISO 27001 Annex A 5.8 Information security in project management

ISO 27001 Annex A 5.8 Information Security in Project Management Explained

ISO 27001 Annex A 5.7 Threat intelligence

ISO 27001 Annex A 5.7 Threat Intelligence Explained

ISO 27001 Annex A 5.6 Contact with special interest groups

ISO 27001 Annex A 5.6 Contact with Special Interest Groups Explained

ISO 27001 Annex A 5.5 Contact with authorities

ISO 27001 Annex A 5.5 Contact with Authorities Explained

ISO 27001 Annex A 5.4 Management responsibilities

ISO 27001 Annex A 5.4 Management Responsibilities Explained

ISO 27001 Annex A 5.3 Segregation of duties

ISO 27001 Annex A 5.3 Segregation of Duties Explained

ISO 27001 Annex A 5.2 Information Security Roles and Responsibilities

ISO 27001 Annex A 5.2 Information Security Roles and Responsibilities Explained

ISO 27001 Annex A 5.1 Policies for information security

ISO 27001 Annex A 5.1 Policies for Information Security Explained

ISO 27002-2022 Ultimate Guide 2026

The complete guide to ISO/IEC 27002:2022