ISO 27001 Annex A Controls: A Complete Guide to All 93 Controls
Published June 28, 2026 · 12 min read
TL;DR
ISO 27001:2022 Annex A contains 93 controls across four categories: Organizational (37), People (8), Physical (14), and Technological (34). You do not need to implement all 93—your Statement of Applicability (SoA) documents which controls apply and why. Most B2B SaaS startups implement 60–75 controls, excluding those related to physical facilities and manufacturing processes.
What Is ISO 27001 Annex A?
ISO 27001 Annex A is the reference control set that organizations use to build their information security management system (ISMS). It is normative—meaning it is part of the standard—but its controls are not all mandatory. Instead, you select which controls to implement based on your risk assessment results, documenting your decisions in a Statement of Applicability.
The 2022 revision of ISO 27001 updated Annex A significantly. The previous 2013 version had 114 controls across 14 domains. The 2022 version restructured this into 93 controls across 4 categories, added 11 new controls (covering threat intelligence, cloud security, and data masking), and merged or renamed many existing ones. If your organization certified under ISO 27001:2013, you needed to transition by October 31, 2025.
The Four Annex A Control Categories
ISO 27001:2022 organizes all 93 controls into four top-level categories. Here is what each category covers, how many controls it contains, and what startup teams typically focus on.
5. Organizational Controls — 37 controls
Organizational controls govern how your company manages information security at a policy and process level. They cover everything from your top-level information security policy to how you manage intellectual property, legal requirements, and supplier relationships.
Key organizational controls for startups:
- 5.1 — Policies for information security: Your master ISMS policy, approved by management
- 5.2 — Information security roles and responsibilities: Who owns security decisions
- 5.8 — Information security in project management: Security built into development sprints
- 5.19 — Information security in supplier relationships: Third-party security assessments
- 5.23 — Information security for use of cloud services: Cloud provider security requirements (new in 2022)
- 5.30 — ICT readiness for business continuity: Disaster recovery planning
Control 5.7 (Threat intelligence) is new in 2022 and often catches startups off guard. It requires a process for gathering and acting on threat intelligence—not just reacting to incidents.
6. People Controls — 8 controls
People controls are the smallest category but among the most impactful. They govern security responsibilities for employees and contractors across the full employment lifecycle: pre-employment screening, security awareness training, disciplinary processes, and offboarding.
| Control | What it covers |
|---|---|
| 6.1 — Screening | Background checks for employees in security-sensitive roles |
| 6.2 — Terms and conditions of employment | Security responsibilities documented in employment agreements |
| 6.3 — Information security awareness, education, and training | Regular security training for all staff |
| 6.4 — Disciplinary process | Formal process for security policy violations |
| 6.5 — Responsibilities after termination or change of employment | Offboarding procedures, access revocation |
| 6.6 — Confidentiality or non-disclosure agreements | NDAs for staff with access to sensitive information |
| 6.7 — Remote working | Security requirements for remote/distributed teams |
| 6.8 — Information security event reporting | How staff report security incidents and near-misses |
Control 6.7 (Remote working) was updated in 2022 to explicitly address the security challenges of distributed teams. For most startups, this is highly applicable.
7. Physical Controls — 14 controls
Physical controls address the security of physical locations, equipment, and media. These range from physical access to server rooms to secure disposal of storage media.
For cloud-native startups with no on-premises infrastructure, many physical controls can be excluded from your SoA with a justification that your cloud provider handles physical security under a shared responsibility model. You will need to document your cloud provider’s physical security certifications (AWS ISO 27001 certification, Azure SOC 2, etc.) as compensating evidence.
Controls that remain relevant even for fully cloud-native companies:
- 7.6 — Working in secure areas: Physical security for offices where sensitive work occurs
- 7.7 — Clear desk and clear screen: Policies for workstations in shared spaces
- 7.8 — Equipment siting and protection: Laptops, endpoint security
- 7.9 — Security of assets off-premises: Remote work device policies
- 7.14 — Secure disposal or re-use of equipment: Device wiping before disposal
8. Technological Controls — 34 controls
Technological controls are the largest category and typically the most familiar to engineering teams. They cover access control, cryptography, network security, vulnerability management, logging, and more.
The 2022 revision added several new technological controls that reflect modern cloud and DevSecOps practices:
- 8.9 — Configuration management: Secure baseline configurations for systems
- 8.10 — Information deletion: Data retention and secure deletion procedures
- 8.11 — Data masking: Anonymization/pseudonymization of sensitive data (new in 2022)
- 8.12 — Data leakage prevention: DLP controls for sensitive data exfiltration (new in 2022)
- 8.16 — Monitoring activities: Security event monitoring and alerting
- 8.23 — Web filtering: Controls for web access from company systems (new in 2022)
- 8.28 — Secure coding: SDLC security practices for development teams
Must-Implement Controls for B2B SaaS Startups
While your specific control selection depends on your risk assessment, these controls are applicable to virtually every B2B SaaS company and are high-priority for auditors:
| Control | Why it matters | Priority |
|---|---|---|
| 5.1 — Information security policy | Foundation of your ISMS; auditors read this first | Critical |
| 5.15 — Access control | Least-privilege access is a core audit focus | Critical |
| 5.17 — Authentication information | Password policy, MFA enforcement | Critical |
| 6.3 — Security awareness training | Auditors want records of training completion | Critical |
| 8.2 — Privileged access rights | Administrative access review and justification | Critical |
| 8.5 — Secure authentication | SSO, MFA, session management | Critical |
| 8.7 — Protection against malware | Endpoint protection, AV, EDR | High |
| 8.8 — Management of technical vulnerabilities | Vulnerability scanning and patching SLAs | High |
| 8.12 — Data leakage prevention | DLP controls for customer data | High |
| 8.24 — Use of cryptography | Encryption at rest and in transit | High |
| 5.24 — Information security incident management | Documented IR process with roles and runbooks | High |
| 5.30 — ICT readiness for business continuity | DR plan and backup verification | High |
Building Your Statement of Applicability
The Statement of Applicability (SoA) is the master document that maps your ISMS to Annex A. For each of the 93 controls, the SoA records:
- Whether the control is included or excluded
- The justification for that decision (risk assessment results, legal requirements, contractual obligations, or business requirements)
- The implementation status
- A reference to the policy, procedure, or technical control that implements it
The SoA is a living document. As your risk profile changes—new products, new markets, new threats—your SoA should be reviewed and updated. Auditors during surveillance audits will check whether your SoA reflects your current operational reality.
Common ISO 27001 Annex A Implementation Mistakes
Treating Annex A as a checklist rather than a risk-driven exercise.
ISO 27001 is explicit: controls are selected based on risk assessment results, not because the list exists. Selecting controls without a documented risk rationale will fail the SoA review.
Excluding physical controls without documentation.
Cloud-native companies correctly exclude many physical controls—but each exclusion needs a justification. 'We use AWS' is not sufficient. Reference your cloud provider's ISO 27001 certificate and the shared responsibility model.
Implementing controls on paper but not in practice.
Stage 2 auditors look for evidence of operation, not just documentation. A vulnerability management policy with no scan records, or an access review procedure with no review minutes, is a nonconformity.
Ignoring the new 2022 controls.
Controls 5.7 (Threat intelligence), 5.23 (Cloud services), 8.11 (Data masking), and 8.12 (Data leakage prevention) are new and relevant to most SaaS companies. Not addressing them suggests the ISMS hasn't been updated for the 2022 standard.
Not maintaining the SoA after initial certification.
Surveillance auditors compare the current SoA against the previous version and your operational changes. A stale SoA that doesn't reflect product pivots or new technology adoption creates unnecessary nonconformities.
How Automation Simplifies Annex A Evidence Collection
The hardest part of implementing ISO 27001 Annex A is not choosing which controls apply—it is collecting and maintaining evidence that those controls operate continuously. Manual evidence collection looks like:
- Exporting access lists from IAM systems every quarter for access reviews (8.2, 8.3)
- Downloading vulnerability scan reports and tracking remediation in a spreadsheet (8.8)
- Collecting training completion records for every new hire (6.3)
- Manually reviewing vendor security questionnaires annually (5.19)
- Screenshotting monitoring dashboards as evidence of 8.16
Multiplied across 60–75 controls over a 12-month observation period, manual evidence collection consumes 40–60% of total compliance effort for most teams. Vylint Shield automates evidence collection by connecting directly to your cloud providers, identity systems, and developer tools—pulling audit-ready evidence for each Annex A control automatically.
The result: your team spends time on genuine security improvements, not compliance paperwork. And when audit week arrives, your evidence is organized, complete, and ready to share.
If you are planning your ISO 27001 timeline, see our guide on how long ISO 27001 takes for a phase-by-phase breakdown with realistic startup timelines.
See how VylintShield handles multiple frameworks from one workflow
One assessment. SOC 2, ISO 27001, HIPAA — mapped from the same policies. No rewrites when your next customer asks for a different framework.
Automate Annex A Evidence Collection
Stop chasing screenshots and spreadsheets. Vylint Shield connects to your tech stack and automatically collects audit evidence for each ISO 27001 Annex A control—so your team focuses on security, not paperwork.
See Vylint Shield in action →