ISO 27001 Annex A: 93 controls training online for practitioners (ISO/IEC 27002:2022)
ISO/IEC 27001:2022 Annex A lists 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). The Statement of Applicability says which ones apply to you; the auditor then asks the control owner how each applicable control is implemented and where the evidence is. That conversation goes badly when the owner knows the control’s title and nothing else. This course, built on the implementation guidance in ISO/IEC 27002:2022, takes practitioners through every control: its purpose, what good looks like, how to implement it, the risks it addresses, the evidence an auditor expects and the common findings and shortcuts that produce nonconformities.
It is written from the auditor’s side of the table by Sterling’s lead auditors, who see the same findings in company after company, and it is the course Sterling assigns to control owners during an ISO 27001 implementation so that the people who sign the Statement of Applicability understand what they are signing.
Contact usSee the course on Sterling AcademyWatch the sample video →
At a glance
| Who it is for | Information security and management system practitioners: ISMS managers, control owners, IT and security leads, internal auditors |
|---|---|
| Format | Self-paced online video, one short video per control, grouped by theme, with quizzes |
| Structure | 58 short videos · 4 control themes · final assessment |
| Access | 12 months |
| On completion | Sterling Academy Certificate of Completion covering 93 controls, numbered, verifiable online |
| List price | From US$119 per learner (51–200 learners), excluding taxes |
Inside the course
Fifty-eight short videos, one control or a small group of related controls per video, grouped into the four Annex A themes, with a quiz after each control group and a checkpoint per theme, followed by a final assessment.
- Organisational controls (5.1 to 5.37) — policies, roles, asset management, access control, supplier relationships, incident management, business continuity, compliance and the controls introduced in 2022 such as threat intelligence and cloud services.
- People controls (6.1 to 6.8) — screening, terms of employment, awareness and training, disciplinary process, responsibilities after termination, confidentiality, remote working and event reporting.
- Physical controls (7.1 to 7.14) — perimeters, entry, securing offices and equipment, clear desk and clear screen, cabling, maintenance and secure disposal.
- Technological controls (8.1 to 8.34) — endpoints, privileged access, authentication, malware protection, vulnerability management, logging and monitoring, backup, cryptography, secure development and the 2022 additions such as data leakage prevention and web filtering.
What learners can do afterwards
- Explain the purpose of each of the 93 controls and where it sits in the four themes.
- Decide, with a risk assessment in hand, whether a control applies and how to justify an exclusion in the Statement of Applicability.
- Implement a control in a way that produces evidence, and recognise the findings auditors raise against it.
- Connect ISO/IEC 27002 guidance to the organisation’s own procedures and records.
Where the course fits in your ISMS
Assign it to everyone named as a control owner in your Statement of Applicability, to the ISMS manager and to the internal audit team before their first audit cycle; internal auditors who have completed it audit controls rather than read them. It pairs with Risk Management for the risk owners whose assessments drive the Statement of Applicability, and with ISO/IEC 27001:2022 Awareness for the rest of the organisation.
For Sterling consulting clients. Sterling consulting clients benefit from preferential course access and special pricing on Sterling Academy through their Sterling consultant, including complimentary ISO 27001 awareness training as part of your engagement. Your consultant sets up your client administrator, you add your people, and every learner who completes the course and its final exam receives a numbered Certificate of Completion, verifiable online.
Related courses
Contact usSee the course on Sterling AcademyWatch the sample video →
This records course completion. It does not confer ISO certification or a professional auditor qualification.
How Sterling Academy fits the Sterling system
Sterling delivers ISO and GRC certification through Sterling OS™ — our delivery operating system: Design™ (guided) or Drive™ (fully managed), then Sustain™, Automate™ and Revise™. Sterling Academy is the training layer of that system: awareness for everyone during implementation, practitioner courses for the people who run the system, and refreshers and new-hire training under Sustain™. Not sure which standard is right for you? Use our Select the Standard™ tool, or request a gap analysis.
What clients say about working with Sterling
Our proof is our clients. Read verbatim feedback from organisations Sterling has taken through ISO and GRC programmes across the Philippines and beyond — named signatories, real letters.
Frequently asked questions
1. Is this the same as an ISO 27001 lead auditor course?
No. It is a practitioner course on the controls themselves. Auditor training is delivered live by Sterling’s lead auditors and issues a Certificate of Competence.
2. How long does it take?
Fifty-eight short videos, typically about three minutes each, plus quizzes and the final assessment; most practitioners complete it over one to two weeks alongside their work. Access runs for 12 months.
3. Does it cover the 2022 changes?
Yes. The course follows ISO/IEC 27001:2022 Annex A and ISO/IEC 27002:2022, including the eleven controls introduced in 2022 and the consolidation of the 2013 controls into 93.
4. Who should take it in a small company?
The person who owns the ISMS and whoever owns IT. In a company of thirty people that is often two or three learners, and the course pays for itself at the first internal audit.
5. What does it cost?
List price from US$119 per learner for 51–200 learners, with higher per-learner rates for smaller groups, excluding taxes. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant as part of an ISO 27001 engagement.