Organizational
A.5.1 → A.5.3737controls
ISO/IEC 27001:2022
The international standard, operated not stored.
93 Annex A controls, 7 management clauses, one Statement of Applicability — kept current as your business changes, not redrafted before each surveillance audit.
93Annex A controls
4Control themes
7Mandatory clauses
3 yrCert + 2 surveillance
Annex A · 4 themes · 93 controls
The 2022 reorganization, mapped
The latest revision collapsed 14 sections into 4 themes. We ship the entire control set ready for applicability decisions on day one.
People
A.6.1 → A.6.88controls
Physical
A.7.1 → A.7.1414controls
Technological
A.8.1 → A.8.3434controls
Clauses 4–10
The mandatory ISMS spine
Annex A is the menu. Clauses 4 through 10 are how you actually run an Information Security Management System.
Context
Stakeholders, scope, ISMS boundary
Leadership
Top management, policy, roles
Planning
Risk + opportunity, treatment
Support
Resources, competence, awareness, comms
Operation
Risk treatment execution, processes
Performance
Monitoring, internal audit, mgmt review
Improvement
Nonconformity, corrective action
Statement of Applicability
One source of truth for what's in scope
The SoA is generated from your applicability decisions. Versioned, signed, exportable — never reverse-engineered the night before fieldwork.
| Annex A code | Control name | Applicable | Source | Justification |
|---|---|---|---|---|
A.5.7 | Threat intelligence | Yes | Adopted | Required for ISMS effectiveness |
A.5.23 | Cloud service use | Yes | Adopted | Multi-tenant SaaS context |
A.5.30 | ICT readiness for BCM | Yes | Excluded | Covered by group BCP framework |
A.7.4 | Physical security monitoring | No | Excluded | No on-prem perimeter — co-lo only |
A.8.16 | Monitoring activities | Yes | Adopted | Backbone of detection program |
A.8.28 | Secure coding | Yes | Adopted | SDLC requirement |
Path to certification
14 weeks to Stage 2
Discover
Scope ISMS, stakeholders, asset inventory baseline
Design
Risk assessment, treatment plan, SoA draft
Deploy
Annex A controls deployed, evidence wired
Audit
Stage 1 doc review, Stage 2 implementation audit
See ISO 27001 in your tenant
Annex A coverage, SoA discipline, and surveillance-audit packaging — all wired in.