ISO 27001 Annex A Controls Explained (2022 Revision)

ISO 27001:2022 reorganised Annex A from 114 controls across 14 domains into 93 controls across four themes. The change is structural rather than a wholesale rewrite, but it is worth understanding how the controls now group together.

The four themes

• Organizational (37 controls) — policies, roles, supplier relationships, threat intelligence, incident management and continuity.
• People (8 controls) — screening, terms of employment, awareness training, and responsibilities after a role ends.
• Physical (14 controls) — secure areas, equipment, clear-desk and secure-disposal practices.
• Technological (34 controls) — access control, cryptography, secure development, logging, monitoring and configuration management.

What's new in 2022

Eleven new controls were introduced, including threat intelligence, information security for cloud services, ICT readiness for business continuity, data leakage prevention, web filtering and secure coding. If you certified under the 2013 version, these are the areas most likely to need fresh attention.

How to approach implementation

Annex A is a reference set, not a mandatory checklist. Your Statement of Applicability justifies which controls apply based on your risk assessment. Start from risk, map each treatment to the relevant Annex A control, and record the evidence that shows the control operating.

Keep controls living

Certification is a point in time; the hard part is keeping controls effective between audits. Complyzing lets you import your control library — it auto-senses the format — then monitors each control continuously and keeps the evidence attached, so your next surveillance audit is a non-event.