ISO 27001 Annex A Controls: The Complete Guide | Osto<\/title>\n<meta name=\"description\" content=\"ISO 27001 Annex A controls explained: all 93 controls across the four themes, the 11 new controls in the 2022 revision, and how the Statement of Applicability decides which apply.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">ISO 27001 Annex A controls explained: the reference set of 93 controls grouped into four themes, in plain language, plus how you decide which ones apply to you.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>10 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>Annex A of ISO 27001:2022 is a reference catalogue of 93 security controls, grouped into four themes: Organizational (37), People (8), Physical (14), and Technological (34). The 2022 revision reorganised the older 114 controls and added 11 new ones.<\/p>\n <p>Annex A is a menu, not a mandatory checklist. Your risk assessment decides which controls apply, and you record those choices in the Statement of Applicability.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#structure\">How Annex A is structured<\/a><\/li>\n <li><a href=\"#org\">Organizational controls (37)<\/a><\/li>\n <li><a href=\"#people\">People controls (8)<\/a><\/li>\n <li><a href=\"#physical\">Physical controls (14)<\/a><\/li>\n <li><a href=\"#tech\">Technological controls (34)<\/a><\/li>\n <li><a href=\"#new\">The 11 new controls<\/a><\/li>\n <li><a href=\"#soa\">Annex A is a menu<\/a><\/li>\n <li><a href=\"#platform\">What a platform can cover<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"structure\">How the ISO 27001 Annex A controls are structured<\/h2>\n <p>Annex A of ISO\/IEC 27001:2022 contains 93 controls, reorganised from the 114 controls and 14 domains of the 2013 version into four clean themes. Each control also mirrors ISO 27002:2022, which is the companion standard that describes how to implement each one in detail.<\/p>\n\n <div style=\"background:#fff;border:1px solid var(--line);border-radius:16px;padding:24px 26px;margin:26px 0;box-shadow:0 6px 24px rgba(16,19,48,.05)\">\n <div style=\"font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;color:#3a46c0;margin-bottom:4px\">ISO 27001:2022 Annex A<\/div>\n <div style=\"font-size:17px;font-weight:800;color:#0e1330;margin-bottom:18px\">93 controls across four themes<\/div>\n <svg viewBox=\"0 0 680 130\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto\" role=\"img\" aria-label=\"Annex A control distribution: 37 Organizational, 8 People, 14 Physical, 34 Technological\">\n <g font-family=\"Inter,Arial,sans-serif\">\n \n <rect x=\"0\" y=\"20\" width=\"266\" height=\"40\" rx=\"5\" fill=\"#1c267a\"\/>\n <rect x=\"270\" y=\"20\" width=\"58\" height=\"40\" rx=\"5\" fill=\"#00c2a8\"\/>\n <rect x=\"332\" y=\"20\" width=\"101\" height=\"40\" rx=\"5\" fill=\"#3a46c0\"\/>\n <rect x=\"437\" y=\"20\" width=\"243\" height=\"40\" rx=\"5\" fill=\"#9d97ff\"\/>\n <text x=\"133\" y=\"45\" text-anchor=\"middle\" fill=\"#fff\" font-size=\"15\" font-weight=\"800\">37<\/text>\n <text x=\"299\" y=\"45\" text-anchor=\"middle\" fill=\"#04261b\" font-size=\"13\" font-weight=\"800\">8<\/text>\n <text x=\"382\" y=\"45\" text-anchor=\"middle\" fill=\"#fff\" font-size=\"15\" font-weight=\"800\">14<\/text>\n <text x=\"558\" y=\"45\" text-anchor=\"middle\" fill=\"#1a1a4a\" font-size=\"15\" font-weight=\"800\">34<\/text>\n \n <g font-size=\"12.5\" font-weight=\"600\">\n <rect x=\"0\" y=\"95\" width=\"13\" height=\"13\" rx=\"3\" fill=\"#1c267a\"\/><text x=\"20\" y=\"106\" fill=\"#0e1330\">Organizational<\/text>\n <rect x=\"150\" y=\"95\" width=\"13\" height=\"13\" rx=\"3\" fill=\"#00c2a8\"\/><text x=\"170\" y=\"106\" fill=\"#0e1330\">People<\/text>\n <rect x=\"250\" y=\"95\" width=\"13\" height=\"13\" rx=\"3\" fill=\"#3a46c0\"\/><text x=\"270\" y=\"106\" fill=\"#0e1330\">Physical<\/text>\n <rect x=\"360\" y=\"95\" width=\"13\" height=\"13\" rx=\"3\" fill=\"#9d97ff\"\/><text x=\"380\" y=\"106\" fill=\"#0e1330\">Technological<\/text>\n <\/g>\n <\/g>\n <\/svg>\n<\/div>\n\n <h2 class=\"sec\" id=\"org\">Organizational controls (37)<\/h2>\n <p>The largest theme. These cover the policies, responsibilities, and processes that set the direction for your whole security program, from access control policy and supplier relationships to incident management and threat intelligence.<\/p>\n\n <h2 class=\"sec\" id=\"people\">People controls (8)<\/h2>\n <p>The smallest theme, and one that no platform can run for you. People are a critical part of the security equation, and these controls cover the human side of the employment lifecycle: screening, terms of employment, security awareness, disciplinary process, and responsibilities after employment ends.<\/p>\n\n <h2 class=\"sec\" id=\"physical\">Physical controls (14)<\/h2>\n <p>These protect the physical environment your information lives in. Just as important as the digital side, and largely tied to your premises and hardware: secure areas, physical entry, equipment protection, secure disposal, and clear-desk practices.<\/p>\n\n <h2 class=\"sec\" id=\"tech\">Technological controls (34)<\/h2>\n <p>The second-largest theme, and the one most people picture when they think of security controls. This is where tooling does most of the work: access control, encryption, logging and monitoring, secure development, malware protection, backup, and network security.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The pattern worth noticing<\/div>Two themes, Organizational and Technological, hold 71 of the 93 controls. These are exactly the areas where a security platform can carry most of the load, while People and Physical controls remain largely your responsibility.<\/div>\n\n <h2 class=\"sec\" id=\"new\">The 11 new controls in the 2022 revision<\/h2>\n <p>The 2022 update did not just reshuffle. It added 11 entirely new controls to reflect how security has changed, especially the shift to cloud and modern development. These are often the most relevant controls for a modern SaaS startup.<\/p>\n\n <table class=\"regtable\">\n <tr><th>New control<\/th><th>What it addresses<\/th><\/tr>\n <tr><td><strong>5.7<\/strong> Threat intelligence<\/td><td>Gathering and using information about threats<\/td><\/tr>\n <tr><td><strong>5.23<\/strong> Cloud services<\/td><td>Information security for the use of cloud services<\/td><\/tr>\n <tr><td><strong>5.30<\/strong> ICT readiness<\/td><td>ICT readiness for business continuity<\/td><\/tr>\n <tr><td><strong>7.4<\/strong> Physical monitoring<\/td><td>Physical security monitoring<\/td><\/tr>\n <tr><td><strong>8.9<\/strong> Configuration management<\/td><td>Managing secure configurations of systems<\/td><\/tr>\n <tr><td><strong>8.10<\/strong> Information deletion<\/td><td>Deleting data when no longer required<\/td><\/tr>\n <tr><td><strong>8.11<\/strong> Data masking<\/td><td>Masking sensitive data in use<\/td><\/tr>\n <tr><td><strong>8.12<\/strong> Data leakage prevention<\/td><td>Preventing unauthorised data exfiltration<\/td><\/tr>\n <tr><td><strong>8.16<\/strong> Monitoring activities<\/td><td>Monitoring systems for anomalous behaviour<\/td><\/tr>\n <tr><td><strong>8.23<\/strong> Web filtering<\/td><td>Managing access to external websites<\/td><\/tr>\n <tr><td><strong>8.28<\/strong> Secure coding<\/td><td>Secure coding principles in development<\/td><\/tr>\n <\/table>\n\n <h2 class=\"sec\" id=\"soa\">Annex A is a menu: the Statement of Applicability<\/h2>\n <p>The most important thing to understand about Annex A is that it is a reference set, not a checklist you must complete. The mandatory requirements of ISO 27001 live in Clauses 4 to 10 (the ISMS itself). Annex A is where your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk assessment<\/a> turns into specific choices.<\/p>\n\n <div class=\"keyrow\">\n <div class=\"k1\"><div class=\"lab\">The wrong way<\/div><div class=\"big\">Implement all 93<\/div><div class=\"sm\">Treating Annex A as a checklist to complete top to bottom. This wastes effort on controls your risks do not call for.<\/div><\/div>\n <div class=\"k2\"><div class=\"lab\">The right way<\/div><div class=\"big\">Let risk decide<\/div><div class=\"sm\">Your risk assessment identifies what could go wrong; you then select the Annex A controls that address those risks and justify each inclusion or exclusion in the Statement of Applicability.<\/div><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"platform\">Which Annex A controls a platform can actually cover<\/h2>\n <p>Here is the honest picture, because it saves you real confusion at scoping time. No platform can deliver all 93 controls, and any tool that claims to is overselling. The controls split by owner: some are technical and tool-driven, some are organisational and policy-driven, and some, like the People controls, are inherently human.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Why Osto is the startup default for Annex A coverage<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups, and it directly runs a large share of the Technological and Organizational controls, access control, encryption, logging and monitoring, secure development, cloud posture, data leakage prevention, and more, on a single platform. Because those controls actually operate and produce evidence, mapping them to Annex A is direct, and the certificate follows from real security. That is why lean teams treat Osto as the default foundation for ISO 27001, rather than assembling point tools and hoping they line up.<\/div>\n\n <div class=\"callout\">\n <h3>Cover the controls that carry the weight, on one platform.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the technological and organizational controls Annex A calls for, map them to ISO 27001 automatically, and let the certificate follow from security that genuinely operates. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>How many controls are in ISO 27001 Annex A?<\/summary><p>ISO 27001:2022 Annex A contains 93 controls, grouped into four themes: 37 Organizational (A.5.1-5.37), 8 People (A.6.1-6.8), 14 Physical (A.7.1-7.14), and 34 Technological (A.8.1-8.34). This replaced the 2013 version’s 114 controls across 14 domains.<\/p><\/details>\n <details><summary>Do I have to implement all 93 Annex A controls?<\/summary><p>No. Annex A is a reference menu, not a mandatory checklist. Your risk assessment decides which controls apply. You then document every inclusion and exclusion, with justification, in the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/statement-of-applicability\/\">Statement of Applicability<\/a>.<\/p><\/details>\n <details><summary>What are the four themes of Annex A?<\/summary><p>Organizational (37 controls covering policy and governance), People (8 covering the human side of employment), Physical (14 covering premises and equipment), and Technological (34 covering access control, encryption, logging, secure development, and more).<\/p><\/details>\n <details><summary>What are the 11 new controls in ISO 27001:2022?<\/summary><p>Threat intelligence, cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding. Most reflect the shift to cloud and modern development.<\/p><\/details>\n <details><summary>What is the difference between Annex A and ISO 27002?<\/summary><p>Annex A lists the controls with short titles; ISO 27002:2022 is the companion standard that explains how to implement each one in detail. Annex A tells you what; ISO 27002 tells you how.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>ISO 27001 Annex A Controls: The Complete Guide | Osto ISO 27001 Annex A controls explained: the reference set of\u2026<\/p>\n","protected":false},"author":8,"featured_media":743,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[252],"class_list":["post-742","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-iso-27001-annex-a"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/742","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=742"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/742\/revisions"}],"predecessor-version":[{"id":744,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/742\/revisions\/744"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/743"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=742"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=742"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=742"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":742,"date":"2026-08-16T16:53:49","date_gmt":"2026-08-16T16:53:49","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=742"},"modified":"2026-08-16T16:53:49","modified_gmt":"2026-08-16T16:53:49","slug":"iso-27001-annex-a-controls","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/iso-27001-annex-a-controls\/","title":{"rendered":"ISO 27001 Annex A Controls: The Complete Guide"},"content":{"rendered":"\n\n\n\n\n\nISO 27001 Annex A Controls: The Complete Guide | Osto<\/title>\n<meta name=\"description\" content=\"ISO 27001 Annex A controls explained: all 93 controls across the four themes, the 11 new controls in the 2022 revision, and how the Statement of Applicability decides which apply.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">ISO 27001 Annex A controls explained: the reference set of 93 controls grouped into four themes, in plain language, plus how you decide which ones apply to you.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>10 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>Annex A of ISO 27001:2022 is a reference catalogue of 93 security controls, grouped into four themes: Organizational (37), People (8), Physical (14), and Technological (34). The 2022 revision reorganised the older 114 controls and added 11 new ones.<\/p>\n <p>Annex A is a menu, not a mandatory checklist. Your risk assessment decides which controls apply, and you record those choices in the Statement of Applicability.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#structure\">How Annex A is structured<\/a><\/li>\n <li><a href=\"#org\">Organizational controls (37)<\/a><\/li>\n <li><a href=\"#people\">People controls (8)<\/a><\/li>\n <li><a href=\"#physical\">Physical controls (14)<\/a><\/li>\n <li><a href=\"#tech\">Technological controls (34)<\/a><\/li>\n <li><a href=\"#new\">The 11 new controls<\/a><\/li>\n <li><a href=\"#soa\">Annex A is a menu<\/a><\/li>\n <li><a href=\"#platform\">What a platform can cover<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"structure\">How the ISO 27001 Annex A controls are structured<\/h2>\n <p>Annex A of ISO\/IEC 27001:2022 contains 93 controls, reorganised from the 114 controls and 14 domains of the 2013 version into four clean themes. Each control also mirrors ISO 27002:2022, which is the companion standard that describes how to implement each one in detail.<\/p>\n\n <div style=\"background:#fff;border:1px solid var(--line);border-radius:16px;padding:24px 26px;margin:26px 0;box-shadow:0 6px 24px rgba(16,19,48,.05)\">\n <div style=\"font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;color:#3a46c0;margin-bottom:4px\">ISO 27001:2022 Annex A<\/div>\n <div style=\"font-size:17px;font-weight:800;color:#0e1330;margin-bottom:18px\">93 controls across four themes<\/div>\n <svg viewBox=\"0 0 680 130\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto\" role=\"img\" aria-label=\"Annex A control distribution: 37 Organizational, 8 People, 14 Physical, 34 Technological\">\n <g font-family=\"Inter,Arial,sans-serif\">\n \n <rect x=\"0\" y=\"20\" width=\"266\" height=\"40\" rx=\"5\" fill=\"#1c267a\"\/>\n <rect x=\"270\" y=\"20\" width=\"58\" height=\"40\" rx=\"5\" fill=\"#00c2a8\"\/>\n <rect x=\"332\" y=\"20\" width=\"101\" height=\"40\" rx=\"5\" fill=\"#3a46c0\"\/>\n <rect x=\"437\" y=\"20\" width=\"243\" height=\"40\" rx=\"5\" fill=\"#9d97ff\"\/>\n <text x=\"133\" y=\"45\" text-anchor=\"middle\" fill=\"#fff\" font-size=\"15\" font-weight=\"800\">37<\/text>\n <text x=\"299\" y=\"45\" text-anchor=\"middle\" fill=\"#04261b\" font-size=\"13\" font-weight=\"800\">8<\/text>\n <text x=\"382\" y=\"45\" text-anchor=\"middle\" fill=\"#fff\" font-size=\"15\" font-weight=\"800\">14<\/text>\n <text x=\"558\" y=\"45\" text-anchor=\"middle\" fill=\"#1a1a4a\" font-size=\"15\" font-weight=\"800\">34<\/text>\n \n <g font-size=\"12.5\" font-weight=\"600\">\n <rect x=\"0\" y=\"95\" width=\"13\" height=\"13\" rx=\"3\" fill=\"#1c267a\"\/><text x=\"20\" y=\"106\" fill=\"#0e1330\">Organizational<\/text>\n <rect x=\"150\" y=\"95\" width=\"13\" height=\"13\" rx=\"3\" fill=\"#00c2a8\"\/><text x=\"170\" y=\"106\" fill=\"#0e1330\">People<\/text>\n <rect x=\"250\" y=\"95\" width=\"13\" height=\"13\" rx=\"3\" fill=\"#3a46c0\"\/><text x=\"270\" y=\"106\" fill=\"#0e1330\">Physical<\/text>\n <rect x=\"360\" y=\"95\" width=\"13\" height=\"13\" rx=\"3\" fill=\"#9d97ff\"\/><text x=\"380\" y=\"106\" fill=\"#0e1330\">Technological<\/text>\n <\/g>\n <\/g>\n <\/svg>\n<\/div>\n\n <h2 class=\"sec\" id=\"org\">Organizational controls (37)<\/h2>\n <p>The largest theme. These cover the policies, responsibilities, and processes that set the direction for your whole security program, from access control policy and supplier relationships to incident management and threat intelligence.<\/p>\n\n <h2 class=\"sec\" id=\"people\">People controls (8)<\/h2>\n <p>The smallest theme, and one that no platform can run for you. People are a critical part of the security equation, and these controls cover the human side of the employment lifecycle: screening, terms of employment, security awareness, disciplinary process, and responsibilities after employment ends.<\/p>\n\n <h2 class=\"sec\" id=\"physical\">Physical controls (14)<\/h2>\n <p>These protect the physical environment your information lives in. Just as important as the digital side, and largely tied to your premises and hardware: secure areas, physical entry, equipment protection, secure disposal, and clear-desk practices.<\/p>\n\n <h2 class=\"sec\" id=\"tech\">Technological controls (34)<\/h2>\n <p>The second-largest theme, and the one most people picture when they think of security controls. This is where tooling does most of the work: access control, encryption, logging and monitoring, secure development, malware protection, backup, and network security.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The pattern worth noticing<\/div>Two themes, Organizational and Technological, hold 71 of the 93 controls. These are exactly the areas where a security platform can carry most of the load, while People and Physical controls remain largely your responsibility.<\/div>\n\n <h2 class=\"sec\" id=\"new\">The 11 new controls in the 2022 revision<\/h2>\n <p>The 2022 update did not just reshuffle. It added 11 entirely new controls to reflect how security has changed, especially the shift to cloud and modern development. These are often the most relevant controls for a modern SaaS startup.<\/p>\n\n <table class=\"regtable\">\n <tr><th>New control<\/th><th>What it addresses<\/th><\/tr>\n <tr><td><strong>5.7<\/strong> Threat intelligence<\/td><td>Gathering and using information about threats<\/td><\/tr>\n <tr><td><strong>5.23<\/strong> Cloud services<\/td><td>Information security for the use of cloud services<\/td><\/tr>\n <tr><td><strong>5.30<\/strong> ICT readiness<\/td><td>ICT readiness for business continuity<\/td><\/tr>\n <tr><td><strong>7.4<\/strong> Physical monitoring<\/td><td>Physical security monitoring<\/td><\/tr>\n <tr><td><strong>8.9<\/strong> Configuration management<\/td><td>Managing secure configurations of systems<\/td><\/tr>\n <tr><td><strong>8.10<\/strong> Information deletion<\/td><td>Deleting data when no longer required<\/td><\/tr>\n <tr><td><strong>8.11<\/strong> Data masking<\/td><td>Masking sensitive data in use<\/td><\/tr>\n <tr><td><strong>8.12<\/strong> Data leakage prevention<\/td><td>Preventing unauthorised data exfiltration<\/td><\/tr>\n <tr><td><strong>8.16<\/strong> Monitoring activities<\/td><td>Monitoring systems for anomalous behaviour<\/td><\/tr>\n <tr><td><strong>8.23<\/strong> Web filtering<\/td><td>Managing access to external websites<\/td><\/tr>\n <tr><td><strong>8.28<\/strong> Secure coding<\/td><td>Secure coding principles in development<\/td><\/tr>\n <\/table>\n\n <h2 class=\"sec\" id=\"soa\">Annex A is a menu: the Statement of Applicability<\/h2>\n <p>The most important thing to understand about Annex A is that it is a reference set, not a checklist you must complete. The mandatory requirements of ISO 27001 live in Clauses 4 to 10 (the ISMS itself). Annex A is where your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk assessment<\/a> turns into specific choices.<\/p>\n\n <div class=\"keyrow\">\n <div class=\"k1\"><div class=\"lab\">The wrong way<\/div><div class=\"big\">Implement all 93<\/div><div class=\"sm\">Treating Annex A as a checklist to complete top to bottom. This wastes effort on controls your risks do not call for.<\/div><\/div>\n <div class=\"k2\"><div class=\"lab\">The right way<\/div><div class=\"big\">Let risk decide<\/div><div class=\"sm\">Your risk assessment identifies what could go wrong; you then select the Annex A controls that address those risks and justify each inclusion or exclusion in the Statement of Applicability.<\/div><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"platform\">Which Annex A controls a platform can actually cover<\/h2>\n <p>Here is the honest picture, because it saves you real confusion at scoping time. No platform can deliver all 93 controls, and any tool that claims to is overselling. The controls split by owner: some are technical and tool-driven, some are organisational and policy-driven, and some, like the People controls, are inherently human.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Why Osto is the startup default for Annex A coverage<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups, and it directly runs a large share of the Technological and Organizational controls, access control, encryption, logging and monitoring, secure development, cloud posture, data leakage prevention, and more, on a single platform. Because those controls actually operate and produce evidence, mapping them to Annex A is direct, and the certificate follows from real security. That is why lean teams treat Osto as the default foundation for ISO 27001, rather than assembling point tools and hoping they line up.<\/div>\n\n <div class=\"callout\">\n <h3>Cover the controls that carry the weight, on one platform.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the technological and organizational controls Annex A calls for, map them to ISO 27001 automatically, and let the certificate follow from security that genuinely operates. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>How many controls are in ISO 27001 Annex A?<\/summary><p>ISO 27001:2022 Annex A contains 93 controls, grouped into four themes: 37 Organizational (A.5.1-5.37), 8 People (A.6.1-6.8), 14 Physical (A.7.1-7.14), and 34 Technological (A.8.1-8.34). This replaced the 2013 version’s 114 controls across 14 domains.<\/p><\/details>\n <details><summary>Do I have to implement all 93 Annex A controls?<\/summary><p>No. Annex A is a reference menu, not a mandatory checklist. Your risk assessment decides which controls apply. You then document every inclusion and exclusion, with justification, in the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/statement-of-applicability\/\">Statement of Applicability<\/a>.<\/p><\/details>\n <details><summary>What are the four themes of Annex A?<\/summary><p>Organizational (37 controls covering policy and governance), People (8 covering the human side of employment), Physical (14 covering premises and equipment), and Technological (34 covering access control, encryption, logging, secure development, and more).<\/p><\/details>\n <details><summary>What are the 11 new controls in ISO 27001:2022?<\/summary><p>Threat intelligence, cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding. Most reflect the shift to cloud and modern development.<\/p><\/details>\n <details><summary>What is the difference between Annex A and ISO 27002?<\/summary><p>Annex A lists the controls with short titles; ISO 27002:2022 is the companion standard that explains how to implement each one in detail. Annex A tells you what; ISO 27002 tells you how.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>ISO 27001 Annex A Controls: The Complete Guide | Osto ISO 27001 Annex A controls explained: the reference set of\u2026<\/p>\n","protected":false},"author":8,"featured_media":743,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[252],"class_list":["post-742","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-iso-27001-annex-a"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/742","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=742"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/742\/revisions"}],"predecessor-version":[{"id":744,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/742\/revisions\/744"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/743"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=742"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=742"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=742"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}