ISO 27001 Annex A organisational controls
ISO 27001:2022 Annex A 5 holds 37 organisational controls: the policies, roles, assets, access rules, supplier and cloud arrangements, incident handling, continuity, legal duties and assurance that let an ISMS run. Three are new in 2022 (5.7, 5.23 and 5.30). Your risk treatment decides which apply, and the Statement of Applicability records why.
The requirement in plain English
Annex A is a reference list of controls, not a set of separate requirements. You compare the controls your risk treatment needs with it, then record each one as included or excluded, with reasons, in the Statement of Applicability (ISO 27001:2022 6.1.3 d)). Once included, a control is something you must operate and evidence.
The organisational theme is the largest of the four. In plain terms its 37 controls fall into these groups.
| Group | Controls | What it covers |
|---|---|---|
| Direction and roles | 5.1–5.4 | Topic-specific policies, security roles, separating conflicting duties, and managers requiring people to follow the rules |
| Outside contacts | 5.5–5.7 | Contact with authorities and specialist groups, and threat intelligence |
| Projects | 5.8 | Security built into project management |
| Assets and information handling | 5.9–5.14 | An inventory with owners, acceptable use, return of assets, classification, labelling and transfer of information |
| Identity and access | 5.15–5.18 | Access rules, identities, passwords and other authentication information, granting and removing access rights |
| Suppliers and cloud | 5.19–5.23 | Supplier risk, security in contracts, the ICT supply chain, monitoring suppliers, and cloud services |
| Incidents | 5.24–5.28 | Planning, assessing events, responding, learning, and collecting evidence |
| Continuity | 5.29–5.30 | Security during disruption, and ICT readiness for continuity |
| Legal and privacy | 5.31–5.34 | Legal, regulatory and contractual requirements, intellectual property, protecting records, privacy and personal data |
| Assurance | 5.35–5.36 | Independent review of your security, and checking compliance with your own policies |
| Operating procedures | 5.37 | Documented procedures for running your systems |
The ISO 27002 guidance explains each control’s purpose and ways to meet it; the control text you are audited against sits in ISO 27001 Annex A.
This is guidance to help you understand the requirement, not legal advice.
What good looks like
A 30-person software company running on one cloud platform includes 35 of the 37 organisational controls. It excludes nothing on the grounds that the cloud provider runs it.
The topic-specific policies sit under the main security policy, each with an owner and an annual review (ISO 27001:2022 Annex A 5.1). The asset inventory lists laptops, cloud accounts, SaaS tools and the data each holds, with an owner per row (ISO 27001:2022 Annex A 5.9). Access follows written rules, joiners and leavers run from one checklist, and access to production is reviewed every quarter, other systems twice a year (ISO 27001:2022 Annex A 5.15).
A supplier register rates each supplier by the data it touches; critical suppliers get a security review before signing and once a year after (ISO 27001:2022 Annex A 5.19). An incident procedure names who decides whether an event is an incident, and a tabletop exercise each year tests it (ISO 27001:2022 Annex A 5.24). A legal and contractual register lists the laws and customer clauses that apply (ISO 27001:2022 Annex A 5.31), and runbooks for deployment, backup and on-call are kept as operating procedures (ISO 27001:2022 Annex A 5.37).
The three controls new in 2022
Threat intelligence (ISO 27001:2022 Annex A 5.7). Named sources, such as national cyber security centre alerts, vendor advisories and a sector sharing group, a person who reads them, and a record of what was acted on. Auditors look for one example where intelligence changed something, such as an emergency patch.
Cloud services (ISO 27001:2022 Annex A 5.23). A register of cloud services, how each is chosen, what security you configure and what the provider does, how you review the provider’s assurance reports, and how you would exit.
ICT readiness for continuity (ISO 27001:2022 Annex A 5.30). Recovery objectives from a business impact analysis, a recovery plan for the systems that matter, and a test that shows the objectives can be met.
Evidence an auditor expects
- Topic-specific policies: approval, owner and review date; the auditor checks staff affected know them.
- Asset inventory: owners, currency, and whether a sampled laptop or SaaS tool is in it.
- Access records: joiner and leaver records and access reviews; the auditor samples a leaver and checks the removal date.
- Supplier register and reviews: risk rating, contract security clauses and the last review for a critical supplier.
- Cloud services register: provider assurance reviewed, shared responsibility understood, exit considered.
- Incident records and a test: the auditor checks events were assessed and incidents handled as the procedure says.
- Continuity tests: a recent test against stated recovery objectives.
- Legal and contractual register: sampled against a real customer contract.
Common mistakes
Excluding supplier and cloud controls because “it is all in the cloud”
The provider runs the data centre, not your configuration, your access rules or your supplier review. Keep the controls and record the shared responsibility.
Segregation of duties waved away
Small teams often mark segregation of duties (ISO 27001:2022 Annex A 5.3) as not applicable. Auditors rarely accept that. Record where duties cannot be split and the compensating controls you use instead.
Access reviews that change nothing
A review signed every quarter with no removals or changes looks like a rubber stamp. Show what was checked and what changed, even when the answer is “nothing to remove”.
An incident procedure never tested
The procedure exists but nobody has used it. Run a tabletop exercise and keep the notes as evidence.
Classification without handling rules
Four classification levels are defined, but nothing says how Confidential data may be shared or stored. Give each level handling rules people can follow.
How Sted helps
- For the ISO 27001 Annex A organisational controls Sted’s knowledge base carries policies and procedures including the Asset Management Policy (POL-ASM), Information Classification Policy (POL-ICP), Access Control Policy (POL-ACC), Supplier Approval and Management Procedure (PRC-SAMP), Cloud Computing Policy (POL-CLD), Incident Management Procedure (PRC-IMP), Business Continuity and Disaster Recovery Policy (POL-BCP) and Threat Intelligence and Vulnerability Management Policy (POL-TIVM), with record templates such as the Asset Record (REC-AR), Access Review Record (REC-ARR), Supplier Review Record (REC-SRR), Cloud System Record (REC-CSR), Information Security Incident Record (REC-ISI) and BC/DR Test Record (REC-BCDRT).
- Records are part of the Full Management System plan.
- 33 periodic record types come with a suggested frequency, but nothing is scheduled until you pick a first due date.
- You can exclude a control with a coded reason and justification and record its implementation status.
- Sted does not connect to your cloud, code or HR systems to collect evidence automatically; you record it.
Sted drafts the policies and holds the records an auditor samples. It does not operate the controls or check your systems; people in your organisation do that and record it.
Related guides and terms
- Supplier due diligence: rating and reviewing suppliers for controls 5.19 to 5.23.
- Access reviews: running and recording a review that holds up.
- Business continuity testing: testing recovery against your objectives.
- Annex A people controls: the next theme.
- ISO 27002 and how it relates to ISO 27001: the guidance behind each control.
Frequently asked questions
Which Annex A organisational controls are new in the 2022 edition?
Three: threat intelligence (5.7), information security for use of cloud services (5.23) and ICT readiness for business continuity (5.30). The other 34 organisational controls carry forward older controls, many of them merged or reworded.
Can a small company ignore segregation of duties?
No, but it can meet it differently. When one person must hold conflicting duties, record why and add compensating controls, such as a second person reviewing changes after the fact, logging, or a periodic review by a director.