Practical ISO/IEC 27001 resources

ISO 27001 Annex A Control Implementation Library

A growing collection of practical implementation guides for all 93 Annex A controls in ISO/IEC 27001:2022. Use the library to move from control titles to concrete actions, evidence and audit-ready practices.

93controls in total4control themes2022current structurePracticalimplementation focus

How to use this library

Choose the theme and control relevant to your risks, scope and Statement of Applicability. Each guide will explain the control's purpose in plain language and provide implementation steps, examples, suggested documentation, possible evidence, useful metrics and common mistakes.

All 93 practical guides are now available. Select a control below to open its implementation guide.

Document your Annex A decisions
Use our free, editable Statement of Applicability workbook to record applicability, justifications, implementation status, owners and evidence for all 93 controls.
Get the free SoA template →

Annex A

Organizational controls

37 controls

Control	Topic	Guide
5.1	Policies for information security	Open guide →
5.2	Information security roles and responsibilities	Open guide →
5.3	Segregation of duties	Open guide →
5.4	Management responsibilities	Open guide →
5.5	Contact with authorities	Open guide →
5.6	Contact with special interest groups	Open guide →
5.7	Threat intelligence	Open guide →
5.8	Information security in project management	Open guide →
5.9	Inventory of information and other associated assets	Open guide →
5.10	Acceptable use of information and other associated assets	Open guide →
5.11	Return of assets	Open guide →
5.12	Classification of information	Open guide →
5.13	Labelling of information	Open guide →
5.14	Information transfer	Open guide →
5.15	Access control	Open guide →
5.16	Identity management	Open guide →
5.17	Authentication information	Open guide →
5.18	Access rights	Open guide →
5.19	Information security in supplier relationships	Open guide →
5.20	Addressing information security within supplier agreements	Open guide →
5.21	Managing information security in the ICT supply chain	Open guide →
5.22	Monitoring, review and change management of supplier services	Open guide →
5.23	Information security for use of cloud services	Open guide →
5.24	Information security incident management planning and preparation	Open guide →
5.25	Assessment and decision on information security events	Open guide →
5.26	Response to information security incidents	Open guide →
5.27	Learning from information security incidents	Open guide →
5.28	Collection of evidence	Open guide →
5.29	Information security during disruption	Open guide →
5.30	ICT readiness for business continuity	Open guide →
5.31	Legal, statutory, regulatory and contractual requirements	Open guide →
5.32	Intellectual property rights	Open guide →
5.33	Protection of records	Open guide →
5.34	Privacy and protection of personally identifiable information (PII)	Open guide →
5.35	Independent review of information security	Open guide →
5.36	Compliance with policies, rules and standards for information security	Open guide →
5.37	Documented operating procedures	Open guide →

Annex A

People controls

8 controls

Control	Topic	Guide
6.1	Screening	Open guide →
6.2	Terms and conditions of employment	Open guide →
6.3	Information security awareness, education and training	Open guide →
6.4	Disciplinary process	Open guide →
6.5	Responsibilities after termination or change of employment	Open guide →
6.6	Confidentiality or non-disclosure agreements	Open guide →
6.7	Remote working	Open guide →
6.8	Information security event reporting	Open guide →

Annex A

Physical controls

14 controls

Control	Topic	Guide
7.1	Physical security perimeters	Open guide →
7.2	Physical entry	Open guide →
7.3	Securing offices, rooms and facilities	Open guide →
7.4	Physical security monitoring	Open guide →
7.5	Protecting against physical and environmental threats	Open guide →
7.6	Working in secure areas	Open guide →
7.7	Clear desk and clear screen	Open guide →
7.8	Equipment siting and protection	Open guide →
7.9	Security of assets off-premises	Open guide →
7.10	Storage media	Open guide →
7.11	Supporting utilities	Open guide →
7.12	Cabling security	Open guide →
7.13	Equipment maintenance	Open guide →
7.14	Secure disposal or re-use of equipment	Open guide →

Annex A

Technological controls

34 controls

Control	Topic	Guide
8.1	User endpoint devices	Open guide →
8.2	Privileged access rights	Open guide →
8.3	Information access restriction	Open guide →
8.4	Access to source code	Open guide →
8.5	Secure authentication	Open guide →
8.6	Capacity management	Open guide →
8.7	Protection against malware	Open guide →
8.8	Management of technical vulnerabilities	Open guide →
8.9	Configuration management	Open guide →
8.10	Information deletion	Open guide →
8.11	Data masking	Open guide →
8.12	Data leakage prevention	Open guide →
8.13	Information backup	Open guide →
8.14	Redundancy of information processing facilities	Open guide →
8.15	Logging	Open guide →
8.16	Monitoring activities	Open guide →
8.17	Clock synchronization	Open guide →
8.18	Use of privileged utility programs	Open guide →
8.19	Installation of software on operational systems	Open guide →
8.20	Network security	Open guide →
8.21	Security of network services	Open guide →
8.22	Segregation of networks	Open guide →
8.23	Web filtering	Open guide →
8.24	Use of cryptography	Open guide →
8.25	Secure development life cycle	Open guide →
8.26	Application security requirements	Open guide →
8.27	Secure system architecture and engineering principles	Open guide →
8.28	Secure coding	Open guide →
8.29	Security testing in development and acceptance	Open guide →
8.30	Outsourced development	Open guide →
8.31	Separation of development, test and production environments	Open guide →
8.32	Change management	Open guide →
8.33	Test information	Open guide →
8.34	Protection of information systems during audit testing	Open guide →

Important: Annex A is a reference set of information security controls. Your organization should select, justify and tailor controls based on its risk assessment, legal and contractual requirements, and ISMS context. This independent learning resource is not affiliated with or endorsed by ISO.