ISO 27001:2022 controls
93 Annex A controls and clauses 4 to 10 held for ISO 27001:2022 (ISO/IEC 27001). Edition: ISO/IEC 27001:2022. Place a control statement and the reader picks the closest text here and the closest matches in the other frameworks. Open ISO 27001:2022 on the standards site.
| Code | Control | Domain | |
|---|---|---|---|
| A.5.1 | Policies for information security | Organizational controls | open |
| A.5.2 | Information security roles and responsibilities | Organizational controls | open |
| A.5.3 | Segregation of duties | Organizational controls | open |
| A.5.4 | Management responsibilities | Organizational controls | open |
| A.5.5 | Contact with authorities | Organizational controls | open |
| A.5.6 | Contact with special interest groups | Organizational controls | open |
| A.5.7 | Threat intelligence | Organizational controls | open |
| A.5.8 | Information security in project management | Organizational controls | open |
| A.5.9 | Inventory of information and other associated assets | Organizational controls | open |
| A.5.10 | Acceptable use of information and other associated assets | Organizational controls | open |
| A.5.11 | Return of assets | Organizational controls | open |
| A.5.12 | Classification of information | Organizational controls | open |
| A.5.13 | Labelling of information | Organizational controls | open |
| A.5.14 | Information transfer | Organizational controls | open |
| A.5.15 | Access control | Organizational controls | open |
| A.5.16 | Identity management | Organizational controls | open |
| A.5.17 | Authentication information | Organizational controls | open |
| A.5.18 | Access rights | Organizational controls | open |
| A.5.19 | Information security in supplier relationships | Organizational controls | open |
| A.5.20 | Addressing information security within supplier agreements | Organizational controls | open |
| A.5.21 | Managing information security in the information and communication technology (ICT) supply chain | Organizational controls | open |
| A.5.22 | Monitoring, review and change management of supplier services | Organizational controls | open |
| A.5.23 | Information security for use of cloud services | Organizational controls | open |
| A.5.24 | Information security incident management planning and preparation | Organizational controls | open |
| A.5.25 | Assessment and decision on information security events | Organizational controls | open |
| A.5.26 | Response to information security incidents | Organizational controls | open |
| A.5.27 | Learning from information security incidents | Organizational controls | open |
| A.5.28 | Collection of evidence | Organizational controls | open |
| A.5.29 | Information security during disruption | Organizational controls | open |
| A.5.30 | ICT readiness for business continuity | Organizational controls | open |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | Organizational controls | open |
| A.5.32 | Intellectual property rights | Organizational controls | open |
| A.5.33 | Protection of records | Organizational controls | open |
| A.5.34 | Privacy and protection of personal identifiable information (PII) | Organizational controls | open |
| A.5.35 | Independent review of information security | Organizational controls | open |
| A.5.36 | Compliance with policies, rules and standards for information security | Organizational controls | open |
| A.5.37 | Documented operating procedures | Organizational controls | open |
| A.6.1 | Screening | People controls | open |
| A.6.2 | Terms and conditions of employment | People controls | open |
| A.6.3 | Information security awareness, education and training | People controls | open |
| A.6.4 | Disciplinary process | People controls | open |
| A.6.5 | Responsibilities after termination or change of employment | People controls | open |
| A.6.6 | Confidentiality or non-disclosure agreements | People controls | open |
| A.6.7 | Remote working | People controls | open |
| A.6.8 | Information security event reporting | People controls | open |
| A.7.1 | Physical security perimeters | Physical controls | open |
| A.7.2 | Physical entry | Physical controls | open |
| A.7.3 | Securing offices, rooms and facilities | Physical controls | open |
| A.7.4 | Physical security monitoring | Physical controls | open |
| A.7.5 | Protecting against physical and environmental threats | Physical controls | open |
| A.7.6 | Working in secure areas | Physical controls | open |
| A.7.7 | Clear desk and clear screen | Physical controls | open |
| A.7.8 | Equipment siting and protection | Physical controls | open |
| A.7.9 | Security of assets off-premises | Physical controls | open |
| A.7.10 | Storage media | Physical controls | open |
| A.7.11 | Supporting utilities | Physical controls | open |
| A.7.12 | Cabling security | Physical controls | open |
| A.7.13 | Equipment maintenance | Physical controls | open |
| A.7.14 | Secure disposal or re-use of equipment | Physical controls | open |
| A.8.1 | User end point devices | Technological controls | open |
| A.8.2 | Privileged access rights | Technological controls | open |
| A.8.3 | Information access restriction | Technological controls | open |
| A.8.4 | Access to source code | Technological controls | open |
| A.8.5 | Secure authentication | Technological controls | open |
| A.8.6 | Capacity management | Technological controls | open |
| A.8.7 | Protection against malware | Technological controls | open |
| A.8.8 | Management of technical vulnerabilities | Technological controls | open |
| A.8.9 | Configuration management | Technological controls | open |
| A.8.10 | Information deletion | Technological controls | open |
| A.8.11 | Data masking | Technological controls | open |
| A.8.12 | Data leakage prevention | Technological controls | open |
| A.8.13 | Information backup | Technological controls | open |
| A.8.14 | Redundancy of information processing facilities | Technological controls | open |
| A.8.15 | Logging | Technological controls | open |
| A.8.16 | Monitoring activities | Technological controls | open |
| A.8.17 | Clock synchronization | Technological controls | open |
| A.8.18 | Use of privileged utility programs | Technological controls | open |
| A.8.19 | Installation of software on operational systems | Technological controls | open |
| A.8.20 | Networks security | Technological controls | open |
| A.8.21 | Security of network services | Technological controls | open |
| A.8.22 | Segregation of networks | Technological controls | open |
| A.8.23 | Web filtering | Technological controls | open |
| A.8.24 | Use of cryptography | Technological controls | open |
| A.8.25 | Secure development life cycle | Technological controls | open |
| A.8.26 | Application security requirements | Technological controls | open |
| A.8.27 | Secure system architecture and engineering principles | Technological controls | open |
| A.8.28 | Secure coding | Technological controls | open |
| A.8.29 | Security testing in development and acceptance | Technological controls | open |
| A.8.30 | Outsourced development | Technological controls | open |
| A.8.31 | Separation of development, test and production environments | Technological controls | open |
| A.8.32 | Change management | Technological controls | open |
| A.8.33 | Test information | Technological controls | open |
| A.8.34 | Protection of information systems during audit testing | Technological controls | open |
| Clause 4.1 | Understanding the organization and its context | Clause 4 | open |
| Clause 4.2 | Understanding the needs and expectations of interested parties | Clause 4 | open |
| Clause 4.3 | Determining the scope of the information security management system | Clause 4 | open |
| Clause 4.4 | Information security management system | Clause 4 | open |
| Clause 5.1 | Leadership and commitment | Clause 5 | open |
| Clause 5.2 | Policy | Clause 5 | open |
| Clause 5.3 | Organizational roles, responsibilities and authorities | Clause 5 | open |
| Clause 6.1.1 | Actions to address risks and opportunities: general | Clause 6 | open |
| Clause 6.1.2 | Information security risk assessment | Clause 6 | open |
| Clause 6.1.3 | Information security risk treatment | Clause 6 | open |
| Clause 6.2 | Information security objectives and planning to achieve them | Clause 6 | open |
| Clause 6.3 | Planning of changes | Clause 6 | open |
| Clause 7.1 | Resources | Clause 7 | open |
| Clause 7.2 | Competence | Clause 7 | open |
| Clause 7.3 | Awareness | Clause 7 | open |
| Clause 7.4 | Communication | Clause 7 | open |
| Clause 7.5.1 | Documented information: general | Clause 7 | open |
| Clause 7.5.2 | Documented information: creating and updating | Clause 7 | open |
| Clause 7.5.3 | Documented information: control | Clause 7 | open |
| Clause 8.1 | Operational planning and control | Clause 8 | open |
| Clause 8.2 | Information security risk assessment | Clause 8 | open |
| Clause 8.3 | Information security risk treatment | Clause 8 | open |
| Clause 9.1 | Monitoring, measurement, analysis and evaluation | Clause 9 | open |
| Clause 9.2.1 | Internal audit: general | Clause 9 | open |
| Clause 9.2.2 | Internal audit programme | Clause 9 | open |
| Clause 9.3.1 | Management review: general | Clause 9 | open |
| Clause 9.3.2 | Management review inputs | Clause 9 | open |
| Clause 9.3.3 | Management review results | Clause 9 | open |
| Clause 10.1 | Continual improvement | Clause 10 | open |
| Clause 10.2 | Nonconformity and corrective action | Clause 10 | open |