Annex A, read as a working list of 93 controls.

A number is a theme plus a position

8.13 is the thirteenth control in theme 8. Themes run from 5 to 8 because the numbering mirrors ISO/IEC 27002, whose first four clauses are introductory.

The name is nearly all you get here

Annex A states each control briefly. The longer explanation sits in ISO/IEC 27002, a separate guidance standard.

Selection starts from risk

Under clause 6.1.3 you choose controls to treat your risks, from any source, then hold them up against Annex A so nothing needed slips through. The list is a cross-check, not an order to adopt every line.

Each theme has its own deeper page on this site, with a typical setup and the evidence an auditor asks for, control by control. The cards under each list below lead there.

1. 5.1
   Policies for information securityA top policy that leadership signs off, narrower subject policies beneath it, both shared with staff and revisited on a schedule.
2. 5.2
   Information security roles and responsibilitiesEvery security duty has a named owner, and each person knows which duties are theirs.
3. 5.3
   Segregation of dutiesSteps that could be abused if one person held them all, such as raising and approving a payment, sit with different people.
4. 5.4
   Management responsibilitiesLine managers expect their teams to work within the security rules and step in when they don't.
5. 5.5
   Contact with authoritiesA current list of the regulators, police and response teams you would call, and who makes each call.
6. 5.6
   Contact with special interest groupsMembership of forums, mailing lists or industry groups that keep your security people informed.
7. 5.7
   Threat intelligenceNew in 2022Gather news about threats that could reach you, make sense of it, and let it shape decisions.
8. 5.8
   Information security in project managementSecurity questions are asked when a project starts and checked again before it closes.
9. 5.9
   Inventory of information and other associated assetsA register of information and the systems holding it, each entry with an accountable owner.
10. 5.10
    Acceptable use of information and other associated assetsWritten rules on how people may use company data and equipment, which they acknowledge.
11. 5.11
    Return of assetsLaptops, badges and data come back when someone leaves or a contract ends.
12. 5.12
    Classification of informationA small set of sensitivity levels, and a rule for deciding which level each piece of information gets.
13. 5.13
    Labelling of informationA practical way to mark documents and systems with their sensitivity level.
14. 5.14
    Information transferRules and safeguards for moving information by email, file share, courier or conversation.
15. 5.15
    Access controlThe written rules for who may reach which systems and spaces, tied to what the business needs.
16. 5.16
    Identity managementEach person and system account is created, tracked and closed through one managed process.
17. 5.17
    Authentication informationPasswords, keys and tokens are issued, stored and reset in a controlled way.
18. 5.18
    Access rightsAccess is requested, approved, reviewed on a cycle and taken away promptly.
19. 5.19
    Information security in supplier relationshipsA process to judge what each vendor could expose and decide what to require of them.
20. 5.20
    Addressing information security within supplier agreementsSecurity obligations written into the contract, scaled to what the vendor touches.
21. 5.21
    Managing information security in the ICT supply chainLook past the direct vendor to the hardware, software and services they in turn depend on.
22. 5.22
    Monitoring, review and change management of supplier servicesCheck that vendors keep their promises over time, and reassess when their service changes.
23. 5.23
    Information security for use of cloud servicesNew in 2022Decide how cloud services are chosen, configured, overseen and exited, including which duties stay with you and which sit with the provider.
24. 5.24
    Information security incident management planning and preparationRoles, contacts and a written playbook in place before anything goes wrong.
25. 5.25
    Assessment and decision on information security eventsA triage step that decides whether an alert or a report is a real incident.
26. 5.26
    Response to information security incidentsContain, fix and communicate according to the playbook, and record what was done.
27. 5.27
    Learning from information security incidentsAfter an incident, find the cause and adjust controls so a repeat is less likely.
28. 5.28
    Collection of evidenceHandle logs and other material from an incident so it stays usable for disciplinary or legal steps.
29. 5.29
    Information security during disruptionPlans that keep protections in place while the business runs in a degraded state.
30. 5.30
    ICT readiness for business continuityNew in 2022Systems and recovery steps are set up and rehearsed so services return within agreed targets.
31. 5.31
    Legal, statutory, regulatory and contractual requirementsA register of the laws, rules and contract terms that bear on security, and how each one is met.
32. 5.32
    Intellectual property rightsUse software and content within licence terms, and protect what you own.
33. 5.33
    Protection of recordsImportant records stay intact, retrievable and safe from tampering for as long as they must be kept.
34. 5.34
    Privacy and protection of PIIPersonal data is handled to the standard set by the privacy laws and contracts that apply to you.
35. 5.35
    Independent review of information securitySomeone not running the programme examines it at planned points and after major change.
36. 5.36
    Compliance with policies, rules and standards for information securityManagers and the security owner check that the rules are actually being followed.
37. 5.37
    Documented operating proceduresWritten steps for routine operational tasks, kept where the people doing those tasks can find them.

• Annex A organizational controlsThe 37 controls of the first theme, grouped by what they do.

1. 6.1
   ScreeningBackground checks before hiring, in proportion to the role and the information it can reach.
2. 6.2
   Terms and conditions of employmentEmployment contracts spell out the security duties of both the employee and the company.
3. 6.3
   Information security awareness, education and trainingEveryone gets security training that fits their job, with refreshers as threats and rules change.
4. 6.4
   Disciplinary processA known, fair process for dealing with people who break the security rules.
5. 6.5
   Responsibilities after termination or change of employmentDuties that outlast a job, such as confidentiality, are explained to the person and still apply.
6. 6.6
   Confidentiality or non-disclosure agreementsConfidentiality agreements that match what you need protected, looked at again from time to time.
7. 6.7
   Remote workingSafeguards for work done from home, on the road or anywhere outside your premises.
8. 6.8
   Information security event reportingA simple, well-known channel for anyone to flag something suspicious without delay.

• Annex A people controlsThe 8 controls on hiring, training, and leaving.

1. 7.1
   Physical security perimetersClear boundaries around the spaces that hold sensitive information or equipment.
2. 7.2
   Physical entryDoors, badges or a reception desk that let only authorised people into protected areas.
3. 7.3
   Securing offices, rooms and facilitiesPhysical protection designed into offices, rooms and facilities from the outset.
4. 7.4
   Physical security monitoringNew in 2022Watch premises, for example with cameras or alarms, to spot anyone entering without permission.
5. 7.5
   Protecting against physical and environmental threatsDefences against fire, flooding, heat and similar hazards to people and equipment.
6. 7.6
   Working in secure areasSpecific rules for what people may do inside restricted areas.
7. 7.7
   Clear desk and clear screenNo sensitive papers or media left out, and screens locked when people step away.
8. 7.8
   Equipment siting and protectionEquipment is placed where it is least exposed to damage, theft or prying eyes.
9. 7.9
   Security of assets off-premisesLaptops, phones and other kit taken outside the office are protected while away.
10. 7.10
    Storage mediaRemovable drives and other media are tracked from issue to destruction.
11. 7.11
    Supporting utilitiesFailures of power, cooling or connectivity do not take critical equipment down unexpectedly.
12. 7.12
    Cabling securityPower and network cables are shielded from tapping, interference and damage.
13. 7.13
    Equipment maintenanceEquipment is serviced correctly so it stays reliable, without exposing data to the people servicing it.
14. 7.14
    Secure disposal or re-use of equipmentData is removed or made unreadable before any device leaves service or changes hands.

• Annex A physical controlsThe 14 controls on sites, equipment and media.

1. 8.1
   User endpoint devicesLaptops, phones and other user devices are configured and managed to protect the data on them.
2. 8.2
   Privileged access rightsAdmin rights are few, granted for a stated reason, and watched closely.
3. 8.3
   Information access restrictionSystems enforce the access rules so people reach only the data their work needs.
4. 8.4
   Access to source codeOnly the right people can read or change code repositories and build tools.
5. 8.5
   Secure authenticationSign-in strength matches what is at stake, such as a second factor for sensitive systems.
6. 8.6
   Capacity managementWatch resource use and plan ahead so systems do not run out of room.
7. 8.7
   Protection against malwareTechnical defences against malicious software, backed by staff who know the warning signs.
8. 8.8
   Management of technical vulnerabilitiesLearn about weaknesses in what you run, judge your exposure, and patch or mitigate in time.
9. 8.9
   Configuration managementNew in 2022Approved secure settings for systems, written down, applied and checked for drift.
10. 8.10
    Information deletionNew in 2022Data is erased once policy, law or contract no longer calls for keeping it.
11. 8.11
    Data maskingNew in 2022Hide or obscure sensitive fields, such as personal data, wherever your rules call for it.
12. 8.12
    Data leakage preventionNew in 2022Tools and checks that notice sensitive data heading somewhere it should not go, and stop it.
13. 8.13
    Information backupCopies of data and systems taken on a schedule, with restores proven by test.
14. 8.14
    Redundancy of information processing facilitiesEnough duplicate capacity that one failure does not stop a critical service.
15. 8.15
    LoggingRecord significant activity, keep the logs safe from tampering, and review them.
16. 8.16
    Monitoring activitiesNew in 2022Watch systems and networks for unusual behaviour, and respond to what you find.
17. 8.17
    Clock synchronizationAll systems keep the same reference time, so logs line up during an investigation.
18. 8.18
    Use of privileged utility programsTools able to bypass normal safeguards are restricted, and their use is controlled.
19. 8.19
    Installation of software on operational systemsOnly approved software reaches production systems, and only by an approved route.
20. 8.20
    Networks securityNetworks and the devices that run them are hardened, managed and controlled.
21. 8.21
    Security of network servicesThe security features and service levels of network services, in-house or bought, are defined and checked.
22. 8.22
    Segregation of networksDifferent groups of users, services and systems are kept on separate network segments.
23. 8.23
    Web filteringNew in 2022Block or limit visits to risky websites to cut exposure to malicious content.
24. 8.24
    Use of cryptographyRules on where encryption is used, and on how keys are created, stored and retired.
25. 8.25
    Secure development life cycleSecurity built into the way software and systems are designed, built and released.
26. 8.26
    Application security requirementsThe security needs of each application are worked out and agreed before it is built or bought.
27. 8.27
    Secure system architecture and engineering principlesAgreed secure design principles, applied whenever systems are engineered or changed.
28. 8.28
    Secure codingNew in 2022Developers follow secure coding practice, and code is checked against it before release.
29. 8.29
    Security testing in development and acceptanceSecurity tests run while software is built and again before a release is accepted.
30. 8.30
    Outsourced developmentCode built by third parties is held to your security requirements and checked.
31. 8.31
    Separation of development, test and production environmentsDevelopment, test and production stay apart, so mistakes and test data keep out of live systems.
32. 8.32
    Change managementChanges to systems follow a defined route of request, approval, testing and record.
33. 8.33
    Test informationData used in testing is chosen with care, protected while in use and removed afterwards.
34. 8.34
    Protection of information systems during audit testingAudit and test work on live systems is agreed in advance so it does not disrupt service.

• Annex A technological controlsThe 34 controls on systems, networks, code and data.

The eleven additions

• 5.7 Threat intelligence
• 5.23 Information security for use of cloud services
• 5.30 ICT readiness for business continuity
• 7.4 Physical security monitoring
• 8.9 Configuration management
• 8.10 Information deletion
• 8.11 Data masking
• 8.12 Data leakage prevention
• 8.16 Monitoring activities
• 8.23 Web filtering
• 8.28 Secure coding

Most of the drop in count came from merging related controls rather than deleting them. The additions cover areas that grew in weight while the 2013 edition was current, such as cloud use, awareness of live threats and data slipping out of the organisation. Certificates to the 2013 edition reached the end of their transition period on 31 October 2025.

Sources: ISO/IEC 27001:2022, Annex A (control numbers and titles only) and clause 6.1.3 (title only); ISO/IEC 27002:2022 (theme structure); IAF MD 26 on the transition to ISO/IEC 27001:2022. Every control summary on this page is Auditify's own wording, not text from either standard.