A Breakdown of ISO 27001:2022 Annex A Controls
When working toward ISO/IEC 27001 certification, your organization will select relevant controls to implement from a checklist called Annex A. Think of Annex A as a catalog of information. Like a portfolio or archive, Annex A consists of a detailed list of security controls that organizations can use to improve their Information Security Management System (ISMS).
In 2022, the ISO/IEC 27001 standard was updated to reflect current security challenges, and one of the biggest changes was within the Annex A controls.
Let’s take a look at our breakdown of the ISO/IEC 27001:2022 Annex A controls so your organization can easily understand what to expect and feel confident going into your audit.
Annex A Controls and Domains
Annex A controls have been both reduced and restructured to reflect the updated ISO/IEC 27001:2022 changes; the number of controls decreased from 114 to 93 and are now categorized from 14 domains into four overarching groups—organizational, people, physical, and technological.
The good news is, these changes make the standard easier to digest and simpler to implement. Here’s more information of each domain, where to find them, and a non-exhaustive list of the type of controls they contain.
Section 5, Organizational (37 controls)
- Organizational information policies
- Cloud service use
- Asset use
Section 6, People (8 controls)
- Remote work
- Confidentiality
- Non-disclosures
- Screening
Section 7, Physical (14 controls)
- Security monitoring
- Storage media
- Maintenance
- Facilities security
Section 8, Technological (34 controls)
- Authentication
- Encryption
- Data leak prevention
Newly Added Annex A Controls
While several of the Annex A controls have been renamed and merged to reduce the total number of controls, the requirements within those controls are almost all the same. The biggest change has been the addition of 11 new controls, added to reflect new and evolving security areas.
Specifically, the control categories are as follows:
- Threat intelligence
- Information security for the use of cloud services
- Information and communications technology for business continuity
- Physical security monitoring
- Configuration management
- Information deletion
- Data masking
- Data leakage prevention
- Monitoring activities
- Web filtering
- Secure coding
For further details and descriptions of these controls, we recommend purchasing the ISO 27001 and 27002 standard and reviewing those documents with your team.
Transitioning to ISO 27001:2022
No matter what stage your organization is in when it comes to ISO/IEC 27001:2022 certification, don’t worry—there’s plenty of time to make the necessary changes.
When conforming to the newly updated ISO 27001:2022 standard, all organizations have a three year transition period. ISO 27001:2013 certificates will expire or be withdrawn no later than October 31, 2025.
For organizations working toward a certification or those with an active certification, you can start incorporating the new standards into your preparations today. A few tips for transitioning your certification to the updated ISO standard include:
- Start by reviewing the standards and updating your ISMS and statement of applicability to align with the revised requirements;
- Incorporate these changes into your risk assessment and management review so that key parties at your organization are on board with the changes; and,
- Reach out to BARR for guidance on the logistics of the transition. We’re happy to help!
Interested in learning more about BARR’s ISO/IEC 27001 certification services? Contact us today.
This blog post was originally published December 15, 2022 and has since been updated to reflect new content.