ISO 27001 Annex A controls, one by one
What each Annex A control asks for in plain words, what an auditor checks, the nonconformities that come up most, the evidence that answers it, and how it maps to SOC 2, NIST CSF, NIS2, DORA and the GDPR.
93 controls in four themes
A.5 · Organizational controls
Policies, roles, assets, access, suppliers, incidents, continuity and compliance: the controls that are decided and documented rather than configured.
- A.5.1 Policies for information security
- A.5.1 asks for an information security policy and topic-specific policies that are approved, published, acknowledged and reviewed on a schedule.
- A.5.2 Information security roles and responsibilities
- A.5.2 asks that security roles and responsibilities are defined and assigned, so every asset, risk, control and process has a named owner.
- A.5.3 Segregation of duties
- A.5.3 asks that conflicting duties are separated, so no one person can both request and approve, or build and deploy, without a second party.
- A.5.4 Management responsibilities
- A.5.4 asks management to require everyone to apply information security as the policies say, through direction, resources and visible follow-up.
- A.5.5 Contact with authorities
- A.5.5 asks you to know which authorities to contact, how and when, for incidents, legal obligations and regulatory reporting, before you need them.
- A.5.6 Contact with special interest groups
- A.5.6 asks you to keep contact with security forums, vendors' advisories and professional groups so threats and fixes reach you early.
- A.5.7 Threat intelligence
- A.5.7 asks you to collect and analyse information about threats so that risk decisions, controls and detection are based on what is actually happening.
- A.5.8 Information security in project management
- A.5.8 asks that every project, not only IT projects, considers information security from the start, with requirements, risks and sign-off built in.
- A.5.9 Inventory of information and other associated assets
- A.5.9 asks for a maintained inventory of information and the assets that hold or process it, each with an owner, as the base for risk and control.
- A.5.10 Acceptable use of information and other associated assets
- A.5.10 asks for rules on how information and assets may be used and handled, communicated to everyone who uses them, including contractors.
- A.5.11 Return of assets
- A.5.11 asks that people and contractors return every organisational asset, physical and informational, when their employment or contract ends.
- A.5.12 Classification of information
- A.5.12 asks for a classification scheme, based on confidentiality, integrity, availability and obligations, applied to information by its owners.
- A.5.13 Labelling of information
- A.5.13 asks for procedures that label information according to its classification so that people and systems can handle it correctly.
- A.5.14 Information transfer
- A.5.14 asks for rules, procedures and agreements that protect information whenever it moves, electronically, physically or in conversation.
- A.5.15 Access control
- A.5.15 asks for rules that decide who may access which information and systems, based on business need and the classification, and that are enforced.
- A.5.16 Identity management
- A.5.16 asks for the full life cycle of every identity to be managed: created for one person or system, verified, changed with the role, and removed.
- A.5.17 Authentication information
- A.5.17 asks that passwords, keys, tokens and other secrets are issued, stored, used and changed in a controlled way, and that people know the rules.
- A.5.18 Access rights
- A.5.18 asks that access rights are granted, changed, reviewed and removed according to the access policy, with records that show each step happened.
- A.5.19 Information security in supplier relationships
- A.5.19 asks for a process that manages the security risks of using suppliers' products and services, from selection to assessment to exit.
- A.5.20 Addressing information security within supplier agreements
- A.5.20 asks that supplier agreements set the security requirements each party owes the other, matched to the information and services involved.
- A.5.21 Managing information security in the ICT supply chain
- A.5.21 asks you to manage the risks in the chain of products and services behind your ICT, including your suppliers' own suppliers and components.
- A.5.22 Monitoring, review and change management of supplier services
- A.5.22 asks you to monitor and review suppliers' security performance and to manage changes to their services, so assurance does not stop at signing.
- A.5.23 Information security for use of cloud services
- A.5.23 asks for a process for choosing, using, managing and leaving cloud services, with the shared responsibilities and your controls on top defined.
- A.5.24 Information security incident management planning and preparation
- A.5.24 asks for an incident management process with defined roles, procedures and communication, prepared and practised before an incident happens.
- A.5.25 Assessment and decision on information security events
- A.5.25 asks that reported events are assessed against agreed criteria and classified, so that real incidents are recognised and prioritised quickly.
- A.5.26 Response to information security incidents
- A.5.26 asks that incidents are handled by the people and procedures the plan defines: contained, eradicated, recovered from, communicated and recorded.
- A.5.27 Learning from information security incidents
- A.5.27 asks you to use what incidents reveal to strengthen controls, update risks and improve the response, rather than closing them and moving on.
- A.5.28 Collection of evidence
- A.5.28 asks for procedures to identify, collect and preserve evidence from incidents in a way that holds up in disciplinary, legal or regulatory action.
- A.5.29 Information security during disruption
- A.5.29 asks you to plan how information security is kept up during a disruption, so continuity arrangements do not become the weakest point.
- A.5.30 ICT readiness for business continuity
- A.5.30 asks that ICT can meet the recovery objectives the business sets, with the capacity, plans and tests to prove it before a disruption.
- A.5.31 Legal, statutory, regulatory and contractual requirements
- A.5.31 asks you to identify the legal, regulatory and contractual requirements that affect information security, keep them current, and meet them.
- A.5.32 Intellectual property rights
- A.5.32 asks for procedures that protect intellectual property, yours and others', covering software licences, copyright and the material people bring in.
- A.5.33 Protection of records
- A.5.33 asks that records are protected from loss, falsification, unauthorised access and release for as long as they must be kept, and then disposed of.
- A.5.34 Privacy and protection of PII
- A.5.34 asks you to identify and meet the privacy and data protection requirements that apply to the personal data you process, with roles and procedures.
- A.5.35 Independent review of information security
- A.5.35 asks for the security approach and its implementation to be reviewed independently at planned intervals and when significant change occurs.
- A.5.36 Compliance with policies, rules and standards for information security
- A.5.36 asks managers to check regularly that the people and systems in their area comply with the security policies, rules and standards, and to fix gaps.
- A.5.37 Documented operating procedures
- A.5.37 asks that the procedures for operating information processing facilities are written down and available to the people who need them.
A.6 · People controls
Security before, during and after employment: screening, terms, awareness, discipline, leavers, confidentiality, remote work and reporting.
- A.6.1 Screening
- A.6.1 asks for background checks on candidates before they join, proportionate to the role, the information they will reach and the law where they work.
- A.6.2 Terms and conditions of employment
- A.6.2 asks that employment and contractor agreements state each person's information security responsibilities and the organisation's, before work starts.
- A.6.3 Information security awareness, education and training
- A.6.3 asks for awareness for everyone and training by role, delivered on joining and repeated, so people know the policies and the threats that apply to them.
- A.6.4 Disciplinary process
- A.6.4 asks for a formal, communicated process for dealing with people who breach the security policies, proportionate and consistent with employment law.
- A.6.5 Responsibilities after termination or change of employment
- A.6.5 asks that security duties which continue after someone leaves or changes role are defined, communicated and enforced, and that handover is managed.
- A.6.6 Confidentiality or non-disclosure agreements
- A.6.6 asks for confidentiality agreements that reflect what needs protecting, signed by staff and external parties before they see it, and reviewed over time.
- A.6.7 Remote working
- A.6.7 asks for rules and controls that protect information when people work away from the organisation's premises, covering devices, networks and surroundings.
- A.6.8 Information security event reporting
- A.6.8 asks for a way for anyone to report security events quickly, known to everyone, so that incidents are noticed when they happen rather than later.
A.7 · Physical controls
Premises, equipment, media and the environment: perimeters, entry, secure areas, utilities, cabling, maintenance and disposal.
- A.7.1 Physical security perimeters
- A.7.1 asks for defined and protected physical boundaries around the areas that hold information and equipment, matched to the sensitivity of what is inside.
- A.7.2 Physical entry
- A.7.2 asks that entry to secure areas is controlled: only authorised people get in, visitors are handled, and entry is recorded and reviewed.
- A.7.3 Securing offices, rooms and facilities
- A.7.3 asks that the offices, rooms and facilities holding information are designed and secured so that what is inside is not visible or reachable from outside.
- A.7.4 Physical security monitoring
- A.7.4 asks for continuous monitoring of premises for unauthorised physical access, with alarms, surveillance or guards suited to the area's sensitivity.
- A.7.5 Protecting against physical and environmental threats
- A.7.5 asks you to assess and protect against physical and environmental threats to premises and equipment, from fire, flood and power loss to deliberate attack.
- A.7.6 Working in secure areas
- A.7.6 asks for rules of conduct inside secure areas: who may be there, what they may bring, supervision of outsiders and what happens when the area is empty.
- A.7.7 Clear desk and clear screen
- A.7.7 asks for rules that keep papers and media off unattended desks and information off unattended screens, enforced by habit and by automatic locking.
- A.7.8 Equipment siting and protection
- A.7.8 asks that equipment is sited and protected so that environmental threats, unauthorised access and prying eyes cannot reach it or what it displays.
- A.7.9 Security of assets off-premises
- A.7.9 asks that devices, media and documents taken outside the premises are protected: encrypted, kept under control, not left unattended, and reported if lost.
- A.7.10 Storage media
- A.7.10 asks for storage media to be managed through its whole life: acquisition, labelling, use, transport and secure disposal, matched to the classification.
- A.7.11 Supporting utilities
- A.7.11 asks that the power, cooling, water and telecoms a facility depends on are protected against failure, with backup and maintenance where needed.
- A.7.12 Cabling security
- A.7.12 asks that power and network cabling is protected from interception, interference and damage, routed and labelled so it can be maintained and checked.
- A.7.13 Equipment maintenance
- A.7.13 asks that equipment is maintained correctly, by authorised people, with records, and with information protected when equipment leaves for repair.
- A.7.14 Secure disposal or re-use of equipment
- A.7.14 asks that equipment is checked before disposal or re-use so that information and licensed software are removed or destroyed, with a record kept.
A.8 · Technological controls
Endpoints, identity and privileged access, malware and vulnerabilities, configuration, data, logging, networks, cryptography and secure development.
- A.8.1 User endpoint devices
- A.8.1 asks that laptops, phones and other user devices are registered, configured securely, encrypted and managed so the information on them stays protected.
- A.8.2 Privileged access rights
- A.8.2 asks that administrative and other privileged access is restricted, granted only when needed, held by separate accounts, monitored and reviewed often.
- A.8.3 Information access restriction
- A.8.3 asks that access to information and application functions is restricted inside systems, in line with the access policy, so users see only what they need.
- A.8.4 Access to source code
- A.8.4 asks that read and write access to source code, development tools and software libraries is controlled, so code cannot be stolen or altered unnoticed.
- A.8.5 Secure authentication
- A.8.5 asks for authentication matched to the sensitivity of what it protects: strong passwords at minimum, multi-factor authentication where risk calls for it.
- A.8.6 Capacity management
- A.8.6 asks you to monitor the use of resources and plan capacity ahead of demand, so systems stay available as load grows and do not fail under it.
- A.8.7 Protection against malware
- A.8.7 asks for protection against malware on every relevant system, backed by user awareness, with detection kept current and alerts acted upon.
- A.8.8 Management of technical vulnerabilities
- A.8.8 asks you to find technical vulnerabilities in your systems, assess the exposure, and fix or mitigate them within timelines set by severity.
- A.8.9 Configuration management
- A.8.9 asks for secure configurations of hardware, software, services and networks to be defined, applied, monitored and kept under change control.
- A.8.10 Information deletion
- A.8.10 asks that information is deleted from systems, devices and services when it is no longer needed, by a method that matches its sensitivity.
- A.8.11 Data masking
- A.8.11 asks for masking, pseudonymisation or anonymisation of sensitive data where people or systems do not need the real values, following the access policy.
- A.8.12 Data leakage prevention
- A.8.12 asks for measures that detect and stop sensitive information leaving through email, web, cloud sharing, devices and other channels without authorisation.
- A.8.13 Information backup
- A.8.13 asks for backups of information, software and systems taken to an agreed policy, stored safely apart from the original, and tested by restoring them.
- A.8.14 Redundancy of information processing facilities
- A.8.14 asks that systems are built with enough redundancy to meet their availability requirements, and that failover is tested rather than assumed.
- A.8.15 Logging
- A.8.15 asks that logs of activities, exceptions, faults and security events are produced, protected from tampering, kept for a defined time and analysed.
- A.8.16 Monitoring activities
- A.8.16 asks that networks, systems and applications are monitored for anomalous behaviour, and that what monitoring finds is evaluated and acted on.
- A.8.17 Clock synchronization
- A.8.17 asks that the clocks of all relevant systems are synchronised to approved time sources, so logs can be correlated and timelines trusted.
- A.8.18 Use of privileged utility programs
- A.8.18 asks that utility programs able to override system and application controls are restricted to the few who need them and their use is controlled.
- A.8.19 Installation of software on operational systems
- A.8.19 asks for rules and controls on installing software on operational systems, so only approved, tested and supported software runs there.
- A.8.20 Networks security
- A.8.20 asks that networks and network devices are secured, managed and controlled to protect the information in systems and applications that use them.
- A.8.21 Security of network services
- A.8.21 asks that the security features, service levels and requirements of network services are identified, agreed and monitored, in-house or from suppliers.
- A.8.22 Segregation of networks
- A.8.22 asks that groups of services, users and systems are separated on the network by trust and sensitivity, so a compromise in one cannot spread freely.
- A.8.23 Web filtering
- A.8.23 asks that access to external websites is managed to reduce exposure to malicious content, by blocking known bad and unwanted destinations.
- A.8.24 Use of cryptography
- A.8.24 asks for rules on when and how cryptography is used, which algorithms and key lengths are allowed, and how keys are managed through their whole life.
- A.8.25 Secure development life cycle
- A.8.25 asks for rules that build security into how software and systems are developed, from requirements and design through coding, testing and release.
- A.8.26 Application security requirements
- A.8.26 asks that security requirements are identified, specified and approved when developing or acquiring applications, based on the information they handle.
- A.8.27 Secure system architecture and engineering principles
- A.8.27 asks for documented principles for engineering secure systems, such as least privilege and defence in depth, applied to every design and reviewed.
- A.8.28 Secure coding
- A.8.28 asks that secure coding principles are applied to all software development, with standards, reviews and tooling that catch common flaws.
- A.8.29 Security testing in development and acceptance
- A.8.29 asks that security is tested during development and before acceptance, against the stated requirements, with the depth set by risk.
- A.8.30 Outsourced development
- A.8.30 asks that development done by suppliers is directed, monitored and reviewed so it meets the same security requirements as in-house work.
- A.8.31 Separation of development, test and production environments
- A.8.31 asks that development, test and production environments are kept apart and protected, so changes and test activity cannot harm live systems or data.
- A.8.32 Change management
- A.8.32 asks that changes to systems and information processing facilities go through change management: recorded, assessed, approved, tested and reversible.
- A.8.33 Test information
- A.8.33 asks that information used for testing is chosen, protected and managed carefully, with production data used only when authorised and protected.
- A.8.34 Protection of information systems during audit testing
- A.8.34 asks that audit tests and assurance activities on operational systems are planned and agreed so they do not disrupt operations or expose information.
Trust, settled.
Noru maps every Annex A control to your own controls, builds the Statement of Applicability from them, and collects the evidence as it happens.