Last updated: 23 October 2026. This page replaces our older article on the “114 controls in 14 categories” of ISO/IEC 27001:2013. That edition has been withdrawn, and certificates against it ended on 31 October 2025.
Annex A of ISO/IEC 27001:2022 lists 93 information security controls grouped into four themes. It replaced the 114 controls in 14 domains (A.5 to A.18) of the 2013 edition. Nothing important was dropped: 11 controls are new, many were merged, and the rest were renamed or updated. This guide lists every 2022 control, shows where each one came from in 2013, and explains what you need to do if your ISMS is still built around the old structure.
ISO 27001:2022 at a glance
| ISO/IEC 27001:2013 | ISO/IEC 27001:2022 | |
|---|---|---|
| Annex A controls | 114 | 93 |
| Structure | 14 domains (A.5–A.18) | 4 themes (5–8) |
| New controls | – | 11 |
| Control guidance | ISO/IEC 27002:2013 | ISO/IEC 27002:2022 (adds attributes such as control type and cybersecurity concepts) |
| Certification status | Withdrawn; certificates ended 31 Oct 2025 | Current (with Amendment 1:2024) |
The management system requirements (clauses 4 to 10) changed only slightly in 2022, for example a new clause 6.3 “Planning of changes”. Amendment 1:2024 added climate action wording to clauses 4.1 and 4.2: organisations must consider whether climate change is a relevant issue and whether interested parties have climate-related requirements.
The four themes
| Theme | Controls | Covers |
|---|---|---|
| 5. Organizational controls | 37 | policies, roles, assets, access, suppliers, incidents, continuity and compliance |
| 6. People controls | 8 | screening, employment terms, awareness, discipline, NDAs, remote working and event reporting |
| 7. Physical controls | 14 | perimeters, entry, secure areas, equipment and media |
| 8. Technological controls | 34 | endpoints, access, malware, vulnerabilities, backup, logging, networks, cryptography and secure development |
The 11 new controls
| Control | Name | What it expects |
|---|---|---|
| 5.7 | Threat intelligence | Collect and analyse information about threats to make better security decisions. |
| 5.23 | Information security for use of cloud services | Define how cloud services are acquired, used, managed and exited securely. |
| 5.30 | ICT readiness for business continuity | Plan, test and maintain ICT readiness so systems can recover within business continuity objectives. |
| 7.4 | Physical security monitoring | Monitor premises continuously for unauthorised physical access (for example CCTV, alarms). |
| 8.9 | Configuration management | Define, document and monitor secure configurations for hardware, software, services and networks. |
| 8.10 | Information deletion | Delete information when it is no longer required, including on systems and devices. |
| 8.11 | Data masking | Mask data (for example pseudonymisation) in line with access control and legal requirements. |
| 8.12 | Data leakage prevention | Apply data leakage prevention to systems, networks and devices that handle sensitive information. |
| 8.16 | Monitoring activities | Monitor networks, systems and applications for anomalous behaviour and act on it. |
| 8.23 | Web filtering | Manage access to external websites to reduce exposure to malicious content. |
| 8.28 | Secure coding | Apply secure coding principles to software development. |
All 93 controls with their 2013 equivalents
Use this table to map an existing 2013-based Statement of Applicability (SoA), risk register or policy set to the 2022 numbering.
5. Organizational controls (37 controls)
| 2022 control | Name | 2013 control(s) |
|---|---|---|
| 5.1 | Policies for information security | A.5.1.1, A.5.1.2 |
| 5.2 | Information security roles and responsibilities | A.6.1.1 |
| 5.3 | Segregation of duties | A.6.1.2 |
| 5.4 | Management responsibilities | A.7.2.1 |
| 5.5 | Contact with authorities | A.6.1.3 |
| 5.6 | Contact with special interest groups | A.6.1.4 |
| 5.7 | Threat intelligence | New |
| 5.8 | Information security in project management | A.6.1.5, A.14.1.1 |
| 5.9 | Inventory of information and other associated assets | A.8.1.1, A.8.1.2 |
| 5.10 | Acceptable use of information and other associated assets | A.8.1.3, A.8.2.3 |
| 5.11 | Return of assets | A.8.1.4 |
| 5.12 | Classification of information | A.8.2.1 |
| 5.13 | Labelling of information | A.8.2.2 |
| 5.14 | Information transfer | A.13.2.1, A.13.2.2, A.13.2.3 |
| 5.15 | Access control | A.9.1.1, A.9.1.2 |
| 5.16 | Identity management | A.9.2.1 |
| 5.17 | Authentication information | A.9.2.4, A.9.3.1, A.9.4.3 |
| 5.18 | Access rights | A.9.2.2, A.9.2.5, A.9.2.6 |
| 5.19 | Information security in supplier relationships | A.15.1.1 |
| 5.20 | Addressing information security within supplier agreements | A.15.1.2 |
| 5.21 | Managing information security in the ICT supply chain | A.15.1.3 |
| 5.22 | Monitoring, review and change management of supplier services | A.15.2.1, A.15.2.2 |
| 5.23 | Information security for use of cloud services | New |
| 5.24 | Information security incident management planning and preparation | A.16.1.1 |
| 5.25 | Assessment and decision on information security events | A.16.1.4 |
| 5.26 | Response to information security incidents | A.16.1.5 |
| 5.27 | Learning from information security incidents | A.16.1.6 |
| 5.28 | Collection of evidence | A.16.1.7 |
| 5.29 | Information security during disruption | A.17.1.1, A.17.1.2, A.17.1.3 |
| 5.30 | ICT readiness for business continuity | New |
| 5.31 | Legal, statutory, regulatory and contractual requirements | A.18.1.1, A.18.1.5 |
| 5.32 | Intellectual property rights | A.18.1.2 |
| 5.33 | Protection of records | A.18.1.3 |
| 5.34 | Privacy and protection of PII | A.18.1.4 |
| 5.35 | Independent review of information security | A.18.2.1 |
| 5.36 | Compliance with policies, rules and standards for information security | A.18.2.2, A.18.2.3 |
| 5.37 | Documented operating procedures | A.12.1.1 |
6. People controls (8 controls)
| 2022 control | Name | 2013 control(s) |
|---|---|---|
| 6.1 | Screening | A.7.1.1 |
| 6.2 | Terms and conditions of employment | A.7.1.2 |
| 6.3 | Information security awareness, education and training | A.7.2.2 |
| 6.4 | Disciplinary process | A.7.2.3 |
| 6.5 | Responsibilities after termination or change of employment | A.7.3.1 |
| 6.6 | Confidentiality or non-disclosure agreements | A.13.2.4 |
| 6.7 | Remote working | A.6.2.2 |
| 6.8 | Information security event reporting | A.16.1.2, A.16.1.3 |
7. Physical controls (14 controls)
| 2022 control | Name | 2013 control(s) |
|---|---|---|
| 7.1 | Physical security perimeters | A.11.1.1 |
| 7.2 | Physical entry | A.11.1.2, A.11.1.6 |
| 7.3 | Securing offices, rooms and facilities | A.11.1.3 |
| 7.4 | Physical security monitoring | New |
| 7.5 | Protecting against physical and environmental threats | A.11.1.4 |
| 7.6 | Working in secure areas | A.11.1.5 |
| 7.7 | Clear desk and clear screen | A.11.2.9 |
| 7.8 | Equipment siting and protection | A.11.2.1 |
| 7.9 | Security of assets off-premises | A.11.2.6 |
| 7.10 | Storage media | A.8.3.1, A.8.3.2, A.8.3.3, A.11.2.5 |
| 7.11 | Supporting utilities | A.11.2.2 |
| 7.12 | Cabling security | A.11.2.3 |
| 7.13 | Equipment maintenance | A.11.2.4 |
| 7.14 | Secure disposal or re-use of equipment | A.11.2.7 |
8. Technological controls (34 controls)
| 2022 control | Name | 2013 control(s) |
|---|---|---|
| 8.1 | User endpoint devices | A.6.2.1, A.11.2.8 |
| 8.2 | Privileged access rights | A.9.2.3 |
| 8.3 | Information access restriction | A.9.4.1 |
| 8.4 | Access to source code | A.9.4.5 |
| 8.5 | Secure authentication | A.9.4.2 |
| 8.6 | Capacity management | A.12.1.3 |
| 8.7 | Protection against malware | A.12.2.1 |
| 8.8 | Management of technical vulnerabilities | A.12.6.1, A.18.2.3 |
| 8.9 | Configuration management | New |
| 8.10 | Information deletion | New |
| 8.11 | Data masking | New |
| 8.12 | Data leakage prevention | New |
| 8.13 | Information backup | A.12.3.1 |
| 8.14 | Redundancy of information processing facilities | A.17.2.1 |
| 8.15 | Logging | A.12.4.1, A.12.4.2, A.12.4.3 |
| 8.16 | Monitoring activities | New |
| 8.17 | Clock synchronization | A.12.4.4 |
| 8.18 | Use of privileged utility programs | A.9.4.4 |
| 8.19 | Installation of software on operational systems | A.12.5.1, A.12.6.2 |
| 8.20 | Networks security | A.13.1.1 |
| 8.21 | Security of network services | A.13.1.2 |
| 8.22 | Segregation of networks | A.13.1.3 |
| 8.23 | Web filtering | New |
| 8.24 | Use of cryptography | A.10.1.1, A.10.1.2 |
| 8.25 | Secure development life cycle | A.14.2.1 |
| 8.26 | Application security requirements | A.14.1.2, A.14.1.3 |
| 8.27 | Secure system architecture and engineering principles | A.14.2.5 |
| 8.28 | Secure coding | New |
| 8.29 | Security testing in development and acceptance | A.14.2.8, A.14.2.9 |
| 8.30 | Outsourced development | A.14.2.7 |
| 8.31 | Separation of development, test and production environments | A.12.1.4, A.14.2.6 |
| 8.32 | Change management | A.12.1.2, A.14.2.2, A.14.2.3, A.14.2.4 |
| 8.33 | Test information | A.14.3.1 |
| 8.34 | Protection of information systems during audit testing | A.12.7.1 |
Moving an ISMS from 2013 to 2022
- Update the Statement of Applicability to the 93 controls, with a justification for each inclusion or exclusion.
- Re-run risk treatment against the new controls, especially the 11 new ones (threat intelligence, cloud services, configuration management, monitoring and data leakage prevention are often gaps).
- Update policies and procedures so they reference the new control numbers and cover the new topics.
- Address the clause changes, including planning of changes (6.3) and the climate-change considerations from Amendment 1:2024.
- Train internal auditors on the new structure and run an internal audit and management review before your certification audit.
Our free ISO 27001 readiness checklist is a quick way to find gaps. For a full gap assessment against the 2022 controls, see our ISO 27001 readiness assessment.
Our ISO 27001 series
Each article below explains one of the 2013 domains in depth and includes a table showing where its controls now sit in the 2022 edition.
- A.5 Information security policies
- A.6 Organization of information security
- A.7 Human resource security
- A.8 Asset management
- A.9 Access control
- A.10 Cryptography
- A.11 Physical and environmental security
- A.12 Operations security
- A.13 Communications security
- A.14 System acquisition, development and maintenance
- A.15 Supplier relationships
- A.16 Information security incident management
- A.17 Business continuity
- A.18 Compliance
Frequently asked questions
Can I still be certified to ISO 27001:2013?
No. Certification bodies stopped certifying to the 2013 edition, and all remaining 2013 certificates expired or were withdrawn after 31 October 2025.
Do I have to implement all 93 controls?
No. You must consider all 93, but you include only those needed to treat your risks (or required by law or contracts), and justify every exclusion in the Statement of Applicability.
Where is the detailed guidance for each control?
In ISO/IEC 27002:2022, which gives purpose and implementation guidance for each control. ISO 27001 Annex A only gives a one-line control statement.
