ISO 27001 Controls Explained (Annex A, 2022)

The controls in ISO 27001 are listed in Annex A of the standard, which works as a reference set and a completeness check. The 2022 version lists 93 controls grouped into four themes: organisational, people, physical and technological. You don’t blindly implement all of them. You determine the controls your risks need, which can be designed by you or drawn from other sources as well as Annex A, check them against Annex A so nothing necessary is missed, and record your decisions in a Statement of Applicability. In audit after audit, the organisations that come unstuck are the ones that treated Annex A as a checklist to tick off rather than a considered response to the risks they’d actually identified. Here’s how that works in practice.

What are ISO 27001 controls?

Controls are the safeguards you put in place to treat information security risks: things like access management, encryption, backups and supplier security. Annex A of ISO/IEC 27001:2022 provides a reference set of 93 controls. They are not a checklist to be implemented wholesale; they’re a menu you draw from based on the risks identified in your risk assessment.

The four control themes

The 2022 update reorganised the previous 114 controls into 93, grouped under four themes:

• Organisational (37 controls): policies, roles, supplier and information-handling controls, threat intelligence and incident management.
• People (8 controls): screening, terms of employment, awareness and training, and what happens when people change or leave roles. Our article on insider threat and coercion shows why they matter.
• Physical (14 controls): secure areas, equipment, clear desk and screen, and protection against physical and environmental threats.
• Technological (34 controls): access control, cryptography, secure development, logging and monitoring, and network and endpoint security.

Do you have to implement all 93?

No. ISO 27001 is risk-based. You assess your risks, decide how to treat them, and then select the Annex A controls that address those risks. Any controls you exclude must be justified. All of this is documented in your Statement of Applicability (SoA), the central document that lists every Annex A control, whether it applies, and why. The SoA is one of the first things a certification auditor will look at. The practical tell I look for is simple: I’ll point at a control marked “applicable” and ask to see it working. If no one can connect it back to a specific risk, or show me any evidence it actually runs, that’s usually where the cracks are.

Applicable to which risk?

This is the gap I find most often in certified systems. The Statement of Applicability has most of the 93 controls marked applicable, and the risk register has a healthy list of risks, but nothing connects the two. Ask which risk control 5.15 (access control) is treating, and nobody can point to one. At that point the SoA is a list of controls the organisation likes the look of, not a response to its risks, and it misses the point of the standard.

Clause 6.1.3 sets out the order. You choose a treatment for each risk, determine the controls needed to carry it out, then compare them with Annex A to make sure nothing necessary has been missed. The Statement of Applicability then lists those necessary controls, which by definition are the ones implementing your risk treatment. So every control marked applicable should be reducing the likelihood or consequence of a specific risk in your register. Legal and contractual obligations are no exception: an obligation you must meet is a source of risk, and it belongs in the register with the controls that treat it. If an applicable control traces to no risk, either the register is incomplete or the control does not need to be there.

The simplest fix is two columns:

• In the risk register: the Annex A controls (and any of your own) that treat each risk.
• In the SoA: the risk references each applicable control is treating.

Run it both ways. Every risk you have chosen to treat should name its controls, and every applicable control should name its risks. Anything left over on either side is either a gap or a control you are maintaining for no reason. We go through the test in detail in ISO 27001 risk assessment and the Statement of Applicability.

How the controls relate to the Essential Eight

Many of the technological controls overlap with Australia’s Essential Eight: multi-factor authentication, patching, application control and backups all appear in both. If you already meet an Essential Eight maturity level, you’ve done a good chunk of the technical work ISO 27001 expects; the standard then adds the governance and risk framework around it. See Essential Eight vs ISO 27001 for how the two fit together.

How to choose your controls

The practical sequence is: define your scope, identify your information assets and risks, decide how to treat each risk, then map the relevant Annex A controls and implement them. Done well, you end up with a right-sized set of controls that genuinely fit your business rather than a bloated system. This is exactly the part where an experienced auditor saves you time, and where AI-built systems most often miss the mark.

Frequently asked questions

How many controls are in ISO 27001:2022?

93 controls across four themes, down from 114 in the 2013 version, which were reorganised and updated (with 11 new controls added) in the 2022 revision.

Are all the controls mandatory?

No. Only the management system clauses (4-10) are mandatory. Annex A controls are selected based on your risk assessment and justified in your Statement of Applicability. See our ISO 27001 requirements checklist for the mandatory parts.

Does every applicable control need to link to a risk?

Yes. Clause 6.1.3 defines the controls in your Statement of Applicability as the ones needed to implement your chosen risk treatment, so each one should point to the risk or risks it treats. If a control is there because of a legal or contractual obligation, record that obligation as a risk in the register and link the control to it.

Speak with an experienced ISO auditor

Want help selecting and implementing the right ISO 27001 controls? Email hello@streamline.business or call us:

• Brisbane 07 3667 8280
• Sydney 02 8315 7780
• Melbourne 03 9034 3990