ISO 27001 Annex A Controls: All 93 Controls of the 2022 Edition, Explained
The complete control list with the evidence an accredited auditor asks for against each one, the eleven controls new in 2022, and how to justify an exclusion that survives Stage 2.
Short answer
ISO/IEC 27001:2022 Annex A contains 93 controls, organised into four themes: A.5 Organizational (37 controls), A.6 People (8), A.7 Physical (14) and A.8 Technological (34). Eleven of the 93 are new in the 2022 edition. The 2013 edition had 114 controls in 14 clauses; the reduction to 93 is the result of merging 24 controls, splitting one and adding 11 — it is a consolidation, not a relaxation.
Annex A is not a checklist you implement top to bottom. Clause 6.1.3 requires you to determine the necessary controls from your risk treatment first, and then compare that set against Annex A to verify that nothing necessary has been omitted. Any consultant who hands you a 93-control implementation plan on day one has inverted the standard.
Total controls
93
Down from 114 in the 2013 edition.
Themes
4
Organizational, People, Physical, Technological.
New in 2022
11
Listed and explained in full further down.
Consolidated
57 → 24
57 of the 2013 controls restated as 24. Nothing was dropped.
Attributes
5
Introduced by ISO/IEC 27002:2022 for filtering.
Mandatory to use all?
No
But every exclusion must be justified in the SoA.
This page is the control-level companion to our full guide on ISO 27001 certification in the Philippines. It lists every one of the 93 ISO 27001 Annex A controls using the standard’s own wording, adds what auditors actually sample against each, and explains the relationship between Annex A and clause 6.1.3 that most implementations get backwards.
How Annex A is structured in the 2022 edition
The single biggest change between the 2013 and 2022 editions of ISO 27001 is not the number of controls — it is the way they are organised. The 2013 edition spread 114 controls across 14 clauses (A.5 to A.18). The 2022 edition groups 93 controls into four themes.
| Theme | Controls | What it covers |
|---|---|---|
| A.5 Organizational | 37 | Policy, roles, asset and information management, access control policy, supplier relationships, incident management, continuity, legal and regulatory compliance. The largest theme by a wide margin, and the one most often underestimated because it is not technical. |
| A.6 People | 8 | Screening, employment terms, awareness and training, discipline, change and termination, NDAs, remote working, and event reporting. |
| A.7 Physical | 14 | Perimeters, entry, secure areas, physical monitoring, environmental threats, equipment, media and secure disposal. |
| A.8 Technological | 34 | Endpoints, privileged access, authentication, malware, vulnerabilities, configuration, logging, monitoring, networks, cryptography, secure development and change management. |
ISO/IEC 27002:2022 — the guidance standard that sits alongside ISO 27001 — carries the implementation detail for each of these controls. ISO 27002 is not certifiable and you are not audited against it; you are audited against ISO 27001, and Annex A is part of ISO 27001. This distinction is covered in full on our page comparing ISO 27001 and ISO 27002.
Annex A is a cross-check, not a shopping list
This is the most consequential misunderstanding in the Philippine market, and it is the reason so many ISO 27001 projects produce a large amount of documentation and a fragile certificate.
Clause 6.1.3 sets out the sequence. You define risk treatment options, you determine all controls necessary to implement the options you chose, and then you compare the controls you determined against Annex A to verify that no necessary control has been omitted. The standard states explicitly that Annex A is a list of possible controls and that organisations can design controls as required or identify them from any source.
The practical consequences:
You may need controls that are not in Annex A. If your risk assessment identifies a risk that no Annex A control addresses, you implement a control anyway and record it in the Statement of Applicability. This is entirely normal for organisations in regulated sectors, and auditors read it as a sign of maturity.
You may exclude Annex A controls — with justification. A company with no software development function does not need A.8.25 to A.8.31. Excluding them is correct. Excluding them without a recorded justification is a nonconformity, because clause 6.1.3 d) requires the SoA to contain the justification for exclusions.
“Applicable” and “implemented” are two different columns. The SoA has to say whether each necessary control is implemented, and a control that is applicable but not yet implemented at Stage 2 is a finding you can see coming months in advance. Our page on the risk assessment and Statement of Applicability covers how to build this properly.
A.5 Organizational controls — all 37
The largest theme, and the one most often underestimated because almost none of it is technical. Policy, roles, asset ownership, supplier management, incident management, continuity and legal compliance all live here. If an ISO 27001 project is running late, it is usually late in A.5.
| Control | Title as worded in Annex A | Evidence a Stage 2 auditor typically asks for |
|---|---|---|
| A.5.1 | Policies for information security | The approved policy set, evidence of top-management approval, the review date, and proof it was communicated to staff and relevant interested parties. |
| A.5.2 | Information security roles and responsibilities | A responsibility allocation the auditor can trace to named people, plus job descriptions or an authority matrix that matches what those people actually do. |
| A.5.3 | Segregation of duties | Which conflicting duties you identified, and how they are separated – or, where separation is impossible, the compensating monitoring you put in place. |
| A.5.4 | Management responsibilities | Evidence that management requires staff to apply security – onboarding acknowledgements, policy sign-off records, performance expectations. |
| A.5.5 | Contact with authorities | Named contacts and the trigger conditions. In the Philippines this means the National Privacy Commission and, for incidents, law enforcement and your regulator. |
| A.5.6 | Contact with special interest groups | Memberships, threat-sharing forums or vendor security advisories you subscribe to, and evidence that what arrives is actually read. |
| A.5.7 | Threat intelligence NEW IN 2022 | The sources, who reviews them, at what frequency, and at least one worked example of intelligence changing a control decision or a risk rating. |
| A.5.8 | Information security in project management | Security requirements visible in project initiation documents and a gate that a project cannot pass without a security assessment. |
| A.5.9 | Inventory of information and other associated assets | A maintained inventory with an owner against every entry. Auditors sample it backwards: they pick a server or an application and ask who owns it. |
| A.5.10 | Acceptable use of information and other associated assets | The acceptable use policy plus signed or system-recorded acknowledgement from a sample of staff, including contractors. |
| A.5.11 | Return of assets | The exit checklist and completed records for people who actually left, reconciled against the asset inventory. |
| A.5.12 | Classification of information | The classification scheme, and evidence it is applied – not just published. Auditors ask a business user what class a given document is. |
| A.5.13 | Labelling of information | Procedures for labelling in each medium you use, and sampled documents, emails or media showing the labels in practice. |
| A.5.14 | Information transfer | Rules for each transfer channel you permit, transfer agreements with third parties, and evidence that prohibited channels are actually blocked. |
| A.5.15 | Access control | The access control policy, and rules that demonstrably follow it – business need, least privilege, and how the two are reconciled. |
| A.5.16 | Identity management | The full identity lifecycle: how identities are created, changed and revoked, and how shared or generic accounts are governed if you allow any. |
| A.5.17 | Authentication information | Password and secret management standards, how initial credentials are issued, and how secrets are stored – a vault, not a spreadsheet. |
| A.5.18 | Access rights | Provisioning and de-provisioning records, and completed periodic access reviews with evidence that findings led to removals. |
| A.5.19 | Information security in supplier relationships | The supplier register with risk ratings, and the process that decides which suppliers get which level of assurance. |
| A.5.20 | Addressing information security within supplier agreements | Actual signed contracts containing the security clauses, not a clause library. Auditors read the contracts of your highest-risk suppliers. |
| A.5.21 | Managing information security in the ICT supply chain | How you assess sub-suppliers and components, including cloud sub-processors your provider engages on your behalf. |
| A.5.22 | Monitoring, review and change management of supplier services | Service review records, SLA reports, and evidence you responded when a supplier changed something material. |
| A.5.23 | Information security for use of cloud services NEW IN 2022 | The cloud acquisition and exit process, the shared-responsibility position for each service, and configuration ownership. |
| A.5.24 | Information security incident management planning and preparation | The incident procedure with defined roles, escalation and severity criteria, agreed before an incident rather than during one. |
| A.5.25 | Assessment and decision on information security events | The triage record showing how events were classified, including the ones you decided were not incidents and why. |
| A.5.26 | Response to information security incidents | Closed incident records with timeline, containment actions and decisions. Auditors prefer a real incident handled well to a clean register. |
| A.5.27 | Learning from information security incidents | Evidence that incident findings changed something – a control, a procedure, a risk rating or a training topic. |
| A.5.28 | Collection of evidence | Procedures for identifying, collecting and preserving evidence in a form that would survive legal or regulatory scrutiny. |
| A.5.29 | Information security during disruption | How security controls are maintained when normal operations fail – including the controls you deliberately relax and who may authorise that. |
| A.5.30 | ICT readiness for business continuity NEW IN 2022 | RTO and RPO derived from a business impact analysis, and ICT continuity plans tested against them with dated test results. |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | A maintained legal register. For Philippine organisations this must include the Data Privacy Act of 2012 and its IRR, plus any sector regulator. |
| A.5.32 | Intellectual property rights | Software licence records reconciled against installed software, and the process that keeps them reconciled. |
| A.5.33 | Protection of records | The retention schedule, and evidence that records are protected against loss, falsification and unauthorised access for their retention period. |
| A.5.34 | Privacy and protection of PII | How PII is identified and protected. In the Philippines auditors look for coherence with your NPC registration and privacy notices. |
| A.5.35 | Independent review of information security | Independent review results at planned intervals. Your internal audit programme can satisfy this if the reviewer is genuinely independent. |
| A.5.36 | Compliance with policies, rules and standards for information security | Compliance checking records – and evidence of what happened when a check found non-compliance. |
| A.5.37 | Documented operating procedures | Procedures for the activities that need them, available to the people who do the work, at the version they are actually using. |
A.6 People controls — all 8
Eight controls covering the employment lifecycle. Small in number, heavily sampled in audit, and the theme where Philippine organisations most often collide with Data Privacy Act obligations — particularly around screening.
| Control | Title as worded in Annex A | Evidence a Stage 2 auditor typically asks for |
|---|---|---|
| A.6.1 | Screening | Background verification records proportionate to the role, obtained lawfully and with consent – a Data Privacy Act consideration in the Philippines. |
| A.6.2 | Terms and conditions of employment | Employment contracts containing information security responsibilities, including for contractors and outsourced staff. |
| A.6.3 | Information security awareness, education and training | A training plan, delivery records, and some measure of effectiveness. Attendance alone is weak evidence; phishing simulation results are strong. |
| A.6.4 | Disciplinary process | A formal, communicated process. Auditors do not need to see it used, but they do need staff to know it exists. |
| A.6.5 | Responsibilities after termination or change of employment | Which obligations survive employment, how they are communicated, and completed records for actual leavers and internal movers. |
| A.6.6 | Confidentiality or non-disclosure agreements | Signed NDAs for staff and third parties, with a defined review cycle and terms that match your actual confidentiality needs. |
| A.6.7 | Remote working | The remote-working policy and the technical controls behind it. Heavily sampled in Philippine BPO and IT audits. |
| A.6.8 | Information security event reporting | The reporting channel, evidence staff know it, and actual reports made through it. A channel nobody has ever used is a finding. |
A.7 Physical controls — all 14
Fourteen controls, most of which an auditor verifies by walking through your premises rather than by reading a document. A.7.5 deserves specific attention in the Philippines: typhoon, flood and seismic exposure are relevant environmental threats and a context analysis that ignores them will be challenged.
| Control | Title as worded in Annex A | Evidence a Stage 2 auditor typically asks for |
|---|---|---|
| A.7.1 | Physical security perimeters | Defined perimeters for areas containing information, and a floor plan the auditor can walk with you. |
| A.7.2 | Physical entry | Access control at entry points, visitor records, and an access list that reconciles to current employees. |
| A.7.3 | Securing offices, rooms and facilities | Physical measures for secure areas, verified on the walk-through rather than from a document. |
| A.7.4 | Physical security monitoring NEW IN 2022 | Continuous monitoring of premises for unauthorised access – CCTV, alarms or guards – with retention and review that satisfy privacy law. |
| A.7.5 | Protecting against physical and environmental threats | Assessment of relevant threats and the protection in place. In the Philippines this means typhoon, flood and seismic risk, explicitly. |
| A.7.6 | Working in secure areas | Rules for working in secure areas, including restrictions on recording devices, and evidence staff are aware of them. |
| A.7.7 | Clear desk and clear screen | The policy plus observation. This one is verified by the auditor looking around your office, not by reading your procedure. |
| A.7.8 | Equipment siting and protection | How equipment is sited to reduce environmental threat and unauthorised access – including screens visible from outside windows. |
| A.7.9 | Security of assets off-premises | Controls for assets outside your sites: laptops, home working equipment, and devices at client premises. |
| A.7.10 | Storage media | The media lifecycle – acquisition, use, transport and disposal – with records for removable media if you permit it. |
| A.7.11 | Supporting utilities | Protection from power and utility failure, with maintenance and test records for UPS and generators. |
| A.7.12 | Cabling security | Protection of power and telecommunications cabling from interception and damage, verified in comms rooms. |
| A.7.13 | Equipment maintenance | Maintenance records in line with supplier specification, and how you protect information when equipment is serviced by a third party. |
| A.7.14 | Secure disposal or re-use of equipment | Disposal records and certificates of destruction. Auditors ask what happened to a specific decommissioned device from your inventory. |
A.8 Technological controls — all 34
The largest technical theme and the one with the most new controls. Six of the eleven 2022 additions sit here. Evidence in A.8 is generally system-generated, which makes it the easiest theme to evidence well and the hardest to fake.
| Control | Title as worded in Annex A | Evidence a Stage 2 auditor typically asks for |
|---|---|---|
| A.8.1 | User endpoint devices | Endpoint protection standards, enrolment records, and how BYOD is handled if you allow it. |
| A.8.2 | Privileged access rights | The list of privileged accounts, how they are approved and time-bound, and review records. Sampled in almost every ISO 27001 audit. |
| A.8.3 | Information access restriction | Restriction in line with the access control policy, demonstrated in the live system rather than described in a document. |
| A.8.4 | Access to source code | Repository permissions, branch protection, and who can approve a merge to production. |
| A.8.5 | Secure authentication | Authentication technique appropriate to the risk. Absence of MFA on internet-facing administrative access is a routine finding. |
| A.8.6 | Capacity management | Monitoring, tuning and forecasting of resources, with evidence of a capacity decision actually taken. |
| A.8.7 | Protection against malware | Coverage across all in-scope endpoints and servers, update status, and evidence of detections being handled. |
| A.8.8 | Management of technical vulnerabilities | Vulnerability scan results, defined remediation timeframes by severity, and proof you met them – or documented risk acceptance where you did not. |
| A.8.9 | Configuration management NEW IN 2022 | Defined secure baselines, how they are applied, and how drift is detected and corrected. |
| A.8.10 | Information deletion NEW IN 2022 | How information is deleted when no longer required, across systems and backups, with retention rules driving it. |
| A.8.11 | Data masking NEW IN 2022 | Masking, pseudonymisation or anonymisation where required – most commonly in non-production environments containing personal data. |
| A.8.12 | Data leakage prevention NEW IN 2022 | Measures applied to systems and networks that handle sensitive information, and evidence that alerts are triaged rather than ignored. |
| A.8.13 | Information backup | The backup policy, backup success records, and restoration tests. An untested backup is not evidence of anything. |
| A.8.14 | Redundancy of information processing facilities | Redundancy sufficient for your availability requirements, tested, with results traced back to the RTO you set. |
| A.8.15 | Logging | What is logged, protection of logs against tampering, and retention. Auditors check that administrators cannot silently edit their own logs. |
| A.8.16 | Monitoring activities NEW IN 2022 | Networks, systems and applications monitored for anomalous behaviour, with defined baselines and an escalation path for what monitoring finds. |
| A.8.17 | Clock synchronization | A common, reliable time source across in-scope systems – without it your log evidence cannot be correlated. |
| A.8.18 | Use of privileged utility programs | Restriction and logging of utilities capable of overriding system controls. |
| A.8.19 | Installation of software on operational systems | Procedures and controls over what can be installed in production, and by whom. |
| A.8.20 | Networks security | Network management and control records, including the current network diagram – which must match reality. |
| A.8.21 | Security of network services | Security mechanisms, service levels and management requirements identified for every network service, in-house or outsourced. |
| A.8.22 | Segregation of networks | Segregation of information services, users and systems, with firewall or VLAN configuration evidencing it. |
| A.8.23 | Web filtering NEW IN 2022 | Managed access to external websites to reduce exposure to malicious content, with the rules and exception process documented. |
| A.8.24 | Use of cryptography | The cryptography policy including key management – generation, storage, rotation and destruction. Key management is where this control usually fails. |
| A.8.25 | Secure development life cycle | Security embedded in the SDLC, evidenced in the development process you actually run rather than one drawn for the audit. |
| A.8.26 | Application security requirements | Security requirements captured and tested for applications you develop or acquire. |
| A.8.27 | Secure system architecture and engineering principles | Documented engineering principles, and evidence they were applied to a real system. |
| A.8.28 | Secure coding NEW IN 2022 | Coding standards, developer training, code review records and any static analysis output. |
| A.8.29 | Security testing in development and acceptance | Test plans and results, including penetration test reports and how findings were closed. |
| A.8.30 | Outsourced development | How you direct, monitor and review outsourced development, including the right to test what is delivered. |
| A.8.31 | Separation of development, test and production environments | Demonstrable separation, and controls over what moves between environments. |
| A.8.32 | Change management | Change records with assessment, approval, testing and back-out plans. Auditors trace a production change end to end. |
| A.8.33 | Test information | How test information is selected, protected and managed – especially where production personal data would otherwise be copied into test. |
| A.8.34 | Protection of information systems during audit testing | How audit activity on operational systems is planned and agreed so that it does not disrupt them. |
The 11 controls that are new in the 2022 edition
These eleven controls did not exist in ISO/IEC 27001:2013. If you were certified against the 2013 edition and transitioned before the 31 October 2025 deadline, these are the controls your transition had to address. If you are certifying for the first time, they are the ones with no legacy evidence anywhere in your organisation.
| Control | Title | What it requires, and where it usually fails |
|---|---|---|
| A.5.7 | Threat intelligence | Collect and analyse information about threats so that action can be taken. The most commonly faked control on this list — a subscription to a newsletter nobody reads is not threat intelligence. Auditors ask for a worked example of intelligence changing a decision. |
| A.5.23 | Information security for use of cloud services | Acquisition, use, management and exit from cloud services. The exit part is the part organisations skip. If you cannot describe how you would leave your primary SaaS provider and what happens to your data, this control is open. |
| A.5.30 | ICT readiness for business continuity | ICT continuity planned, implemented, maintained and tested against objectives derived from a business impact analysis. Note the word tested: an untested plan does not satisfy this control. |
| A.7.4 | Physical security monitoring | Continuous monitoring of premises for unauthorised physical access. In the Philippines, where CCTV is near-universal, the gap is usually retention, review and the Data Privacy Act basis for the footage — not the cameras. |
| A.8.9 | Configuration management | Configurations of hardware, software, services and networks defined, documented, implemented, monitored and reviewed. This is the control that turns ad-hoc server builds into a baseline you can audit against. |
| A.8.10 | Information deletion | Deletion of information when no longer required, in systems, devices and other storage. Backups are the hard part, and the honest answer usually involves retention periods rather than surgical deletion. |
| A.8.11 | Data masking | Masking in accordance with the access control policy and business requirements, taking applicable legislation into account. For most Philippine organisations the driver is copying live personal data into test environments. |
| A.8.12 | Data leakage prevention | Measures applied to systems, networks and devices that process, store or transmit sensitive information. A DLP tool generating alerts nobody triages is worse evidence than no tool and a defensible manual process. |
| A.8.16 | Monitoring activities | Networks, systems and applications monitored for anomalous behaviour, with appropriate action taken to evaluate potential incidents. Distinct from A.8.15 Logging: logging records, monitoring notices. |
| A.8.23 | Web filtering | Access to external websites managed to reduce exposure to malicious content. Straightforward to implement, and one of the few new controls that is genuinely quick to close. |
| A.8.28 | Secure coding | Secure coding principles applied to software development. Applicable to anyone who writes code, including internal automation and scripts — not only product engineering teams. |
The five attributes in ISO/IEC 27002:2022
ISO/IEC 27002:2022 assigns five attributes to every control. They are not requirements and you are not audited on them, but they are genuinely useful: they let you filter 93 controls into the view a particular audience needs.
| Attribute | Values it takes | What it is good for |
|---|---|---|
| Control type | Preventive, detective, corrective | Showing management that your control set is not 90 per cent preventive with nothing that would tell you an attack succeeded. |
| Information security properties | Confidentiality, integrity, availability | Checking coverage against your risk assessment. Most Philippine organisations over-weight confidentiality and under-weight availability until their first outage. |
| Cybersecurity concepts | Identify, protect, detect, respond, recover | Mapping straight onto the NIST Cybersecurity Framework, which is how you answer a US client asking for NIST alignment without running a second programme. |
| Operational capabilities | Governance, asset management, information protection, human resource security, physical security, system and network security, application security, secure configuration, identity and access management, threat and vulnerability management, continuity, supplier relationships security, legal and compliance, information security event management, information security assurance | Assigning controls to the team that will actually own them. This is the most practically useful attribute during implementation. |
| Security domains | Governance and ecosystem, protection, defence, resilience | Board-level reporting, where four categories land better than ninety-three. |
From 114 controls to 93: what actually changed
The drop from 114 to 93 is routinely misread as ISO 27001 becoming easier. It did not. Here is the actual arithmetic.
| What happened | Count | Effect |
|---|---|---|
| Controls consolidated | 57 → 24 | Fifty-seven of the 2013 controls were restated as twenty-four consolidated controls. Nothing was dropped; overlapping requirements are now stated once instead of twice. |
| Control split | 1 → 2 | One 2013 control was separated into two, because it had been carrying two distinct obligations. |
| Carried forward individually | 56 | Retained one-for-one, many under revised titles and with rewritten guidance in ISO/IEC 27002:2022. |
| New controls added | 11 | The eleven listed above, addressing cloud, monitoring, configuration, data protection and secure development. |
| Controls removed entirely | 0 | No 2013 requirement was abandoned. Every obligation survives, either in its own control or inside a consolidated one. |
| Net result | 114 → 93 | 24 + 2 + 56 + 11 = 93, drawn from 57 + 1 + 56 = 114. Fewer control numbers, the same scope of obligation, plus eleven genuinely new areas of work. |
ISO/IEC 27001:2022 also carries Amendment 1:2024, which adds to clause 4.1 a requirement to determine whether climate change is a relevant issue, and a note to clause 4.2 recording that interested parties can have climate-related requirements. It changes no Annex A control — it changes your context analysis. Auditors have been raising findings against it since 2025.
How to justify excluding a control in your SoA
Clause 6.1.3 d) requires the Statement of Applicability to contain the necessary controls, justification for their inclusion, whether they are implemented, and the justification for excluding any Annex A control. Exclusions are legitimate. Unjustified exclusions are a nonconformity.
A justification that holds up has three properties: it states a fact about your organisation, that fact is verifiable, and it does not contradict anything else in your ISMS.
| Control | Justification that works | Justification that gets you a finding |
|---|---|---|
| A.8.25–A.8.31 (development controls) | “The organisation does not develop, modify or maintain software. All applications in scope are commercial SaaS, managed under A.5.19 to A.5.23.” | “Not applicable.” Two words, no fact, no verification path. Also fails if the auditor finds a Power Automate flow or an internal script — that is software development. |
| A.7.x (physical controls) | “The organisation operates fully remotely with no premises. Physical risk to endpoints is addressed under A.7.9 and A.8.1; cloud data-centre physical security is addressed through supplier assurance under A.5.19.” | “We work from home so physical security does not apply.” It still applies — it has moved, not vanished. This justification invites the auditor to look harder. |
| A.8.11 (data masking) | “No personal or sensitive data is used in non-production environments; test data is synthetically generated. Verified by the quarterly test-data review under A.8.33.” | “We do not have the tooling.” Lack of a tool is not a justification for exclusion. It is an unresolved risk. |
| A.6.1 (screening) | Rarely excludable. If you employ anyone in scope, this applies. | “Philippine labour law prevents background checks.” It does not; it constrains how they are done and requires a lawful basis under the Data Privacy Act. Misstating the law in an SoA is worse than the exclusion. |
Sterling Academy · e-learning for your people
Training that stands up in your ISO 27001 audit
Sterling consulting clients benefit from preferential course access and special pricing on Sterling Academy through their Sterling consultant, including complimentary ISO 27001 awareness training for your people as part of your engagement. Your consultant sets up your client administrator, you add your people, and every learner who completes a course and its final exam receives a numbered Certificate of Completion, verifiable online.
Completion records and certificates are your evidence for ISO/IEC 27001:2022 clauses 7.2 (competence) and 7.3 (awareness) and for Annex A control 6.3, information security awareness, education and training — the items a certification auditor tests by interviewing your staff.
Courses for an information security management system
End to end with Sterling: your ISO 27001 engagement includes
- Implementation consulting through Design™ (guided) or Drive™ (fully managed), up to the certification audit
- Sterling Academy e-learning for your people: preferential course access and special pricing, with complimentary ISO 27001 awareness training
- Live internal auditor training for your audit team
- Effivity ISMS software subscription
- Vulnerability assessment by Cyber Vantage 360
- Sustain™ post-certification support: internal audits, management reviews and surveillance preparation
List price from US$19 per learner per course (51–200 learners) · 12 months’ access · final exam included
Contact usSee the course on Sterling AcademyWatch the sample video →
Certificate of Completion issued after the final exam, numbered and verifiable online · Sterling consultant, client administrator and learner roles as on Sterling Academy
ISO 27001 Annex A controls: frequently asked questions
1. How many controls are in ISO 27001:2022?
Ninety-three, organised into four themes: A.5 Organizational with 37 controls, A.6 People with 8, A.7 Physical with 14, and A.8 Technological with 34. The 2013 edition had 114 controls across 14 clauses.
2. What are the four themes of Annex A in ISO 27001:2022?
Organizational controls (A.5), People controls (A.6), Physical controls (A.7) and Technological controls (A.8). The four-theme structure replaced the 14-clause structure used in the 2013 edition, and each control also carries five attributes defined in ISO/IEC 27002:2022.
3. Which controls are new in ISO 27001:2022?
Eleven controls are new: A.5.7 Threat intelligence, A.5.23 Information security for use of cloud services, A.5.30 ICT readiness for business continuity, A.7.4 Physical security monitoring, A.8.9 Configuration management, A.8.10 Information deletion, A.8.11 Data masking, A.8.12 Data leakage prevention, A.8.16 Monitoring activities, A.8.23 Web filtering and A.8.28 Secure coding.
4. Do I have to implement all 93 Annex A controls?
No. Clause 6.1.3 requires you to determine the controls necessary to implement your chosen risk treatment options, then compare that set against Annex A to verify nothing necessary was omitted. Controls that are not necessary can be excluded, but the Statement of Applicability must record the justification for every exclusion.
5. Why did ISO 27001 go from 114 controls to 93?
Because overlapping requirements are now stated once, not because the standard asks for less. Fifty-seven of the 2013 controls were consolidated into twenty-four, one was split into two, fifty-six were carried forward individually, and eleven new controls were added: 24 + 2 + 56 + 11 = 93. No 2013 requirement was removed, so a control set built against the 2013 edition still has somewhere to go.
6. Is Annex A a checklist?
No, and treating it as one is the most common implementation error. Annex A is a reference set used to cross-check the controls your risk treatment already produced. The standard is explicit that organisations can design controls as required or identify them from any source, so a necessary control that Annex A does not contain still belongs in your Statement of Applicability.
7. What is the difference between ISO 27001 Annex A and ISO 27002?
Annex A is part of ISO 27001 and lists the 93 control titles. ISO/IEC 27002:2022 is a separate, non-certifiable guidance standard that gives the purpose, implementation guidance and attributes for each of those controls. You are audited against ISO 27001; you use ISO 27002 to work out how to satisfy it.
8. What evidence do auditors ask for against Annex A controls?
Records produced by the control operating, not descriptions of the control. For access rights they want completed access reviews with removals; for backup they want restoration test results; for vulnerability management they want scan output, defined remediation timeframes and proof you met them. A policy stating that a control exists is the weakest form of evidence available.
9. Does Amendment 1:2024 add new Annex A controls?
No. Amendment 1:2024 adds to clause 4.1 a requirement to determine whether climate change is a relevant issue, and a note to clause 4.2 recording that interested parties can have climate-related requirements. Annex A is unchanged by it, but your context analysis is not.
10. Can we add controls that are not in Annex A?
Yes, and mature organisations do. If your risk assessment identifies a risk that no Annex A control addresses, you implement a control from another source and record it in the Statement of Applicability alongside the Annex A controls. Auditors read this as evidence that your risk process is real rather than reverse-engineered.
Get your Statement of Applicability built from real risk, not a template
Sterling runs the risk assessment first and derives the controls from it, in the order clause 6.1.3 actually specifies. If your current SoA marks all 93 controls applicable and implemented, we can tell you in one session which of those claims your evidence would survive.
Talk to a Sterling ISO 27001 consultant
11. Is training included with Sterling’s ISO 27001 consulting?
Every Sterling engagement includes live internal auditor training for your audit team and preferential access to Sterling Academy, with complimentary ISO 27001 awareness training for your people as part of the engagement. Special pricing applies to the wider catalogue — Information Security Essentials, 93 Annex A Controls (ISO/IEC 27002:2022) and Risk Management — through your Sterling consultant. Learners who complete a course and its final exam receive a numbered Certificate of Completion, verifiable online, and the completion records serve as evidence for clauses 7.2 and 7.3 and Annex A control 6.3.
Where to go next
- ISO 27001 certification in the Philippines — the complete guide.
- Risk assessment and the Statement of Applicability — where your control set is supposed to come from.
- The 15 mandatory documents — what the standard actually requires you to write.
- ISO 27001 certification cost in the Philippines — published ranges.
- Transitioning from the 2013 edition — if you missed 31 October 2025.
- ISO 27001 for fintech in the Philippines — BSP, NPC and SEC supervision, cloud scoping and the diligence pack banks ask for.
Written and maintained by the ISO 27001 practice at Sterling International Consulting, Philippines. All clause and control references are to ISO/IEC 27001:2022 including Amendment 1:2024. Last updated: 1 August 2026.