The 93 ISO 27001 Controls Explained: A Simplified Checklist
Quick answer: ISO 27001:2022 has 93 controls in four themes: 37 Organizational, 8 People, 14 Physical, and 34 Technological. That is down from 114 controls in 2013, with 11 new controls added, and you only implement the ones your risk assessment justifies.
Annex A of ISO/IEC 27001:2022 lists 93 information security controls grouped into four themes. The 2013 edition had 114 controls in 14 domains, and the 2022 update merged overlap and modernized the language without lowering the security bar.
Annex A names the controls, while ISO/IEC 27002:2022 explains each one in detail. You choose the controls your risk assessment justifies and record your reasoning in the Statement of Applicability, so the real skill is knowing what each theme covers.
What changed in ISO 27001:2022
Of the 93 controls, 11 are new, 24 are merged from existing controls, and 58 are updated. The security intent carried over, and the structure became simpler to scope, document, and audit.
114 controls became 93
Overlapping controls were consolidated into clearer, broader ones without losing intent.
Four themes replaced 14 domains
Controls now sit in Organizational, People, Physical, and Technological themes.
Modern practices added
New controls cover cloud services, threat intelligence, secure coding, and data leakage prevention.
Risk-based selection stays central
You are not required to implement all 93, only the controls your risks justify, with exclusions explained.
Easier audits
Fewer, clearer controls make the Statement of Applicability and evidence mapping simpler.
ISO 27001:2013 vs ISO 27001:2022
Fewer controls does not mean weaker security. The change is about clarity and relevance, not about lowering the bar.
| Factor | ISO 27001:2013 | ISO 27001:2022 |
|---|---|---|
| Number of controls | 114 | 93 |
| Structure | 14 domains (A.5 to A.18) | 4 themes (A.5 to A.8) |
| New controls | Not applicable | 11 added |
| Merged controls | Not applicable | 24 merged from existing controls |
| Certificate status | Expired on 31 October 2025 | Current standard |
Still on the 2013 version? The transition period closed on 31 October 2025 with no extension. An organization that missed it needs a new initial certification audit against the 2022 edition, so mapping your old risk register and Statement of Applicability to the 93 controls is the place to start.
The four control categories in ISO 27001:2022
The 93 controls follow the Annex A numbering, so each theme maps to a clause range. Most organizations find it easiest to assign an owner to each theme.
37
Organizational
A.5.1 to A.5.37
8
People
A.6.1 to A.6.8
14
Physical
A.7.1 to A.7.14
34
Technological
A.8.1 to A.8.34
1. Organizational controls (A.5)
The largest theme covers how security is governed: policies, roles, asset and information handling, access rules, suppliers, incidents, continuity, and legal requirements. If a control is about how the organization decides and manages rather than a tool or a door lock, it usually sits here.
Typical audit evidence: approved policies, the risk register, supplier assessments, and incident records.
| Key control | What it means |
|---|---|
| A.5.1 Policies for information security | Management approves, publishes, and regularly reviews security policies. |
| A.5.7 Threat intelligence NEW | Collect and analyze threat information to inform your defenses. |
| A.5.15 Access control | Rules limit access to information and assets based on business and security needs. |
| A.5.19 Information security in supplier relationships | Manage the security risk that suppliers and vendors introduce. |
| A.5.23 Information security for use of cloud services NEW | Set rules for acquiring, using, managing, and exiting cloud services. |
| A.5.24 Incident management planning and preparation | Define how incidents will be handled before one occurs. |
| A.5.30 ICT readiness for business continuity NEW | Make sure ICT systems can meet continuity objectives during a disruption. |
2. People controls (A.6)
This is the smallest theme, with eight controls that cover the human side of security across employees, contractors, and third parties. All eight are listed below.
Typical audit evidence: training records, signed agreements, onboarding checklists, and offboarding logs.
| Control | What it means |
|---|---|
| A.6.1 Screening | Background checks proportionate to the role and the risk. |
| A.6.2 Terms and conditions of employment | Employment contracts state each person’s security responsibilities. |
| A.6.3 Awareness, education, and training | Staff receive security training suited to their role. |
| A.6.4 Disciplinary process | A formal process exists for security policy violations. |
| A.6.5 Responsibilities after termination or change | Security duties continue after someone leaves or changes roles. |
| A.6.6 Confidentiality or non-disclosure agreements | Signed agreements protect sensitive information. |
| A.6.7 Remote working | Security measures apply to people working outside the office. |
| A.6.8 Information security event reporting | A simple channel lets staff report suspected events quickly. |
3. Physical controls (A.7)
These 14 controls protect sites, rooms, and equipment. A cloud-first company can often rely on its hosting provider’s assurance for data center controls, but office and remote-work controls still apply.
Typical audit evidence: visitor logs, access card records, equipment disposal records, and provider certificates.
| Key control | What it means |
|---|---|
| A.7.1 Physical security perimeters | Define and protect the boundaries of areas holding information. |
| A.7.2 Physical entry | Control and record who enters secure areas. |
| A.7.4 Physical security monitoring NEW | Monitor premises for unauthorized physical access, for example with alarms or CCTV. |
| A.7.7 Clear desk and clear screen | Keep sensitive material and screens out of view when unattended. |
| A.7.10 Storage media | Manage removable and portable media through its whole life cycle. |
| A.7.14 Secure disposal or re-use of equipment | Remove or overwrite data before equipment is discarded or reused. |
4. Technological controls (A.8)
Only 34 of the 93 controls are technical. They cover the IT estate: identity and access, cryptography, networks, logging, backups, vulnerability management, and secure development.
Typical audit evidence: access reviews, configuration baselines, vulnerability scan and VAPT reports, backup restore tests, and log samples.
| Key control | What it means |
|---|---|
| A.8.2 Privileged access rights | Restrict and manage administrator-level access. |
| A.8.5 Secure authentication | Use authentication methods suited to the risk, such as multi-factor authentication. |
| A.8.8 Management of technical vulnerabilities | Find, assess, and fix vulnerabilities in a timely way. |
| A.8.13 Information backup | Back up information and test that restores actually work. |
| A.8.15 Logging | Record, protect, and review activity logs. |
| A.8.24 Use of cryptography | Define rules for encryption and key management. |
| A.8.28 Secure coding NEW | Apply secure coding principles across software development. |
The 11 new controls in ISO 27001:2022
These are the controls auditors tend to probe first, because they reflect modern cloud and data risks. Three are organizational, one is physical, and seven are technological.
| New control | Theme | Why it matters |
|---|---|---|
| A.5.7 Threat intelligence | Organizational | Threat information shapes which risks you prioritize. |
| A.5.23 Cloud services security | Organizational | Cloud use needs defined requirements from selection to exit. |
| A.5.30 ICT readiness for business continuity | Organizational | Systems must be able to meet recovery objectives. |
| A.7.4 Physical security monitoring | Physical | Detects unauthorized physical access to premises. |
| A.8.9 Configuration management | Technological | Secure configurations are documented, applied, and reviewed. |
| A.8.10 Information deletion | Technological | Data is deleted once it is no longer needed. |
| A.8.11 Data masking | Technological | Limits exposure of sensitive data through masking or pseudonymization. |
| A.8.12 Data leakage prevention | Technological | Detects and blocks unauthorized disclosure of sensitive information. |
| A.8.16 Monitoring activities | Technological | Networks and systems are watched for anomalous behavior. |
| A.8.23 Web filtering | Technological | Reduces exposure to malicious websites and content. |
| A.8.28 Secure coding | Technological | Builds security into software development from the start. |
How CyberSapiens helps simplify the 93 ISO 27001 controls
The challenge is rarely the number of controls. It is knowing which apply, how to implement them, and how to prove them at audit. CyberSapiens turns the 93 controls into a risk-driven, audit-ready roadmap.
1. Risk-based control selection
Controls are chosen from your risk assessment, scope, and legal obligations, not implemented by default, which avoids needless overhead.
2. Risk-to-control mapping
Every risk is mapped to Annex A controls, giving auditors clear traceability and supporting Clause 6.1.
3. A concise Statement of Applicability
Each inclusion or exclusion is justified with risk, legal, and business context, which cuts follow-up questions and non-conformities.
4. Implementation beyond policies
Controls are made to work across people, process, and technology, including access enforcement, cloud configuration, and awareness.
5. Technical validation through VAPT
Vulnerability assessment and penetration testing validates access, configuration, and vulnerability controls with real-world evidence.
6. Moving legacy documentation to 2022
Risk registers, policies, and the SoA built on the 114-control model are mapped to the 93-control structure, preparing lapsed 2013 holders for certification against the 2022 edition.
7. Audit-ready evidence
Logs, access reviews, incident records, and test results are mapped to controls, and internal audits run with a certification-audit mindset.
8. Continuous improvement
Periodic risk reassessment, control reviews, ongoing VAPT, and surveillance audit preparation keep the ISMS effective as you scale.
Clients Served by CyberSapiens
Making the 93 ISO 27001 controls practical
The move from 114 controls to 93 simplified ISO 27001 without diluting it. The value lies in understanding what each theme covers, selecting only what your risks justify, and keeping evidence that proves the controls work.
FAQs
Does having fewer controls mean weaker security?
No. The 93 controls keep the same security intent as the earlier version but are clearer, broader, and better aligned with modern risks and technologies.
Do organizations need to implement all 93 ISO 27001 controls?
No. ISO 27001 is risk-based, so you implement the controls that apply to your risks and scope and justify every exclusion in the Statement of Applicability.
How many controls are in each ISO 27001:2022 category?
There are 37 Organizational controls, 8 People controls, 14 Physical controls, and 34 Technological controls, which total 93.
What are the 11 new controls in ISO 27001:2022?
They are threat intelligence, cloud services security, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding.
What happened to ISO 27001:2013 certificates?
They expired on 31 October 2025 when the transition period ended. Organizations that missed it need a new initial certification audit against the 2022 edition.
Are technical controls like VAPT included in the 93 controls?
Annex A does not require penetration testing by name, but technological controls such as A.8.8 (management of technical vulnerabilities) and A.8.29 (security testing in development and acceptance) are commonly evidenced through VAPT.
