Control catalogue · 14 categories · 114 controls
ISO 27002 — Annex A
Annex A of ISO 27001:2013 is the control catalogue, and its text mirrors ISO/IEC 27002:2013. It holds 14 control categories and 114 controls. During an ISO 27001 audit you are assessed against the control text in 27001, but 27002 gives the extended implementation guidance for each one. This page summarises every category and its objective.
→Why does Annex A start at A.5?
It looks odd that the controls begin at A.5 rather than A.1. The reason is that Annex A maps directly onto ISO 27002, where sections 1–4 are introductory and explanatory, so the controls themselves start at section 5. In an ISO 27001 certification audit you are audited only against the control text within 27001 — but there's real benefit in reading the extended guidance on each control in 27002.
→A.5 Information security policies 2 controls
How policies are written and reviewed.
- A.5.1.1 Policies for information security — a set of policies defined, approved by management, published and communicated to staff and relevant external parties. They form the backbone of security and feed into the awareness programme (links to A.7.2.2).
- A.5.1.2 Review of the policies — reviewed at planned intervals, or when significant change occurs, to keep them suitable, adequate and effective.
→A.6 Organisation of information security 7 controls
Assigning responsibility for specific tasks; mobile devices and teleworking.
Important for who-does-what and delegation. Tasks needing several pairs of eyes (e.g. paying out funds) shouldn't sit with one person — a kind of dual verification. During incidents it must be clear who the single point of contact (SPOC) is for authorities and interest groups.
→A.7 Human resource security 6 controls
Ensuring staff understand their responsibilities before, during and after employment.
A.7.1 Prior to employment
A.7.2 During employment
A.7.3 Termination & change
An auditor wants evidence that leavers returned assets and the process was closed and documented, with the asset inventory updated (A.8.1.1). A common failing is forgetting to remove or delete old data belonging to former colleagues — ISO forces this to be a described, performed task.
→A.8 Asset management 10 controls
Identifying information assets and defining appropriate protection responsibilities.
A.8.1 Responsibility for assets
A.8.2 Information classification
Classification and labelling work much like the TLP (Traffic Light Protocol) you may already know.
A.8.3 Media handling
Proper equipment disposal is often neglected because it's expensive — unless you handle hardware destruction yourself. Maps to CIS Controls 1 & 2 (inventory of enterprise assets and software).
→A.9 Access control 14 controls
Ensuring employees can only see information relevant to their role.
A.9.1 Business requirements of access control
A.9.2 User access management
A.9.3 User responsibilities
→A.10 Cryptography 2 controls
Encryption and key management of sensitive information — to protect confidentiality, authenticity and/or integrity.
→A.11 Physical and environmental security 15 controls
Securing the organisation's premises and equipment.
A.11.1 Secure areas
A.11.2 Equipment
→A.12 Operations security 14 controls
Ensuring information processing facilities are secure.
A.12.1 Operational procedures & responsibilities
A.12.2 Protection from malware
A.12.3 Backup
A.12.4 Logging & monitoring
A.12.5 Control of operational software
A.12.6 Technical vulnerability management
A.12.7 Information systems audit considerations
→A.13 Communications security 7 controls
Protecting information in networks and in transit.
A.13.1 Network security management
A.13.2 Information transfer
→A.14 System acquisition, development & maintenance 13 controls
Making information security a central part of systems across the whole lifecycle.
A.14.1 Security requirements of information systems
A.14.2 Security in development & support
A.14.3 Test data
→A.15 Supplier relationships 5 controls
What to put in third-party contracts, and how to check the agreements are kept.
A.15.1 Information security in supplier relationships
A.15.2 Supplier service delivery management
In a GDPR context this is where the data processing agreement (databehandleraftale) lives — a written contract governing how a processor handles personal data on your behalf.
→A.16 Information security incident management 7 controls
How to report disruptions and breaches, and who owns which activity.
The objective is a consistent, effective approach across the whole lifecycle of incidents, events and weaknesses. This is the bridge to emergency/contingency management and IR playbooks — see the Defencia IR phases and emergency management pages.
→A.17 Business continuity 4 controls
Information security aspects of business continuity management — addressing business disruption.
A.17.1 Information security continuity
A.17.2 Redundancies
→A.18 Compliance 8 controls
Identifying the laws and regulations that apply, and reviewing that security is implemented as intended.
A.18.1 Compliance with legal & contractual requirements
A.18.2 Information security reviews
→Related
This catalogue is selected and justified in the Statement of Applicability under ISO 27001. Risk drives that selection — see ISO 27005. The CIS Controls map across to Annex A as a more technical, prioritised companion.