ISO 27001 Annex A technological controls
ISO 27001:2022 Annex A 8 holds 34 technological controls: device and access security, protection against malware and vulnerabilities, configuration, data deletion and leakage, backup, logging and monitoring, networks, cryptography and secure development. Seven are new in 2022. They are the controls an auditor checks against your live systems, not just your policies.
The requirement in plain English
The technological theme of Annex A is where policy meets configuration. Its 34 controls fall into these groups.
| Group | Controls | What it covers |
|---|---|---|
| Devices and access | 8.1–8.5 | Endpoint devices, privileged access, restricting access to information and source code, and secure authentication |
| Keeping systems sound | 8.6–8.9 | Capacity, malware protection, technical vulnerabilities and configuration management |
| Protecting data | 8.10–8.14 | Deleting information, masking data, preventing leakage, backups and redundancy |
| Logging and monitoring | 8.15–8.17 | Logs, monitoring for anomalies and synchronised clocks |
| Controlling operational systems | 8.18–8.19 | Utility programs that can override controls, and installing software |
| Networks | 8.20–8.23 | Securing networks and network services, separating networks, and web filtering |
| Cryptography | 8.24 | Rules for using cryptography, including keys |
| Building software | 8.25–8.31, 8.33 | Secure development life cycle, security requirements, secure architecture, secure coding, security testing, outsourced development, separate environments and test data |
| Change | 8.32 | Changes to systems go through change management |
| Audit testing | 8.34 | Planning audit tests so they do not disrupt live systems |
The seven controls new in 2022
- Configuration management (ISO 27001:2022 Annex A 8.9): defined secure baselines for devices, servers and cloud services, with changes controlled and drift detected.
- Information deletion (ISO 27001:2022 Annex A 8.10): data deleted when no longer needed, from systems, devices and suppliers, with a record of it.
- Data masking (ISO 27001:2022 Annex A 8.11): masking, pseudonymising or anonymising data where people or systems do not need to see it in full.
- Data leakage prevention (ISO 27001:2022 Annex A 8.12): measures that stop sensitive data leaving through email, uploads, removable media or unmanaged apps.
- Monitoring activities (ISO 27001:2022 Annex A 8.16): watching networks, systems and applications for unusual behaviour and acting on it, beyond collecting logs (ISO 27001:2022 Annex A 8.15).
- Web filtering (ISO 27001:2022 Annex A 8.23): managing access to external websites to reduce exposure to malicious content.
- Secure coding (ISO 27001:2022 Annex A 8.28): secure coding principles applied in development, with tooling and review that show it.
Your risk treatment decides which controls apply; a company that writes no software can exclude most of the development group, with that reason.
This is guidance to help you understand the requirement, not legal advice.
What good looks like
A 40-person SaaS company on one public cloud applies 33 of the 34 controls. It excludes only outsourced development (ISO 27001:2022 Annex A 8.30), because it has none, and records that reason.
Laptops are managed centrally: encrypted, screen-locked, patched automatically, with endpoint protection and USB storage blocked. Production access goes through single sign-on with multi-factor authentication; privileged roles are granted for a limited time and reviewed each quarter (ISO 27001:2022 Annex A 8.2). Cloud resources are built from infrastructure code that serves as the configuration baseline, and a cloud security tool flags drift weekly.
Critical vulnerabilities are patched within 14 days, tracked to closure (ISO 27001:2022 Annex A 8.8). Logs from production, the identity provider and the cloud control plane go to one place, kept for a year, with alerts on a short list of suspicious events reviewed each working day. Backups run daily and a restore is tested every quarter against the recovery objective (ISO 27001:2022 Annex A 8.13).
Developers follow a secure coding standard, every change is peer reviewed, and dependency and static analysis scans run in the pipeline. Customer data never goes into test environments without masking. Every production change has a ticket, an approval and a link to the commit (ISO 27001:2022 Annex A 8.32).
Evidence an auditor expects
- Device management reports: encryption, patch level and protection status for a sample of laptops.
- Access reviews and privileged access lists: the auditor compares who has admin rights with who should.
- Configuration baselines and drift reports: for 8.9, the auditor asks what the baseline is and how you know systems match it.
- Vulnerability records: scan results with fix dates against your stated timescales.
- Logs and alert handling: the auditor picks an alert and asks what happened next.
- Backup and restore test results: dated, with the restore time achieved.
- Development evidence: code review records, pipeline scan results and a sample change traced from request to deployment.
- Deletion and masking records: how a customer’s data was deleted at contract end, and how test data is prepared.
Common mistakes
Logs collected, never reviewed
Logging is turned on everywhere, but nobody looks unless something breaks. Monitoring (8.16) needs someone watching. Define a short list of alerts that matter and keep a record of their review.
Configuration management without a baseline
The policy says systems are hardened, but nobody can say to what standard. Pick a recognised benchmark or write your own baseline, then check against it.
Patch timescales that are not met
The policy promises 14 days for critical patches; scan results show 60. Auditors compare the two directly. Set timescales you can meet and report against them.
Secure coding as a statement of intent
“Developers write secure code” is not evidence. Show the standard, the review step and the tooling results.
Deletion that stops at your own systems
Customer data is deleted from production but lingers in backups, logs, analytics and supplier systems. Map where data goes and record deletion in each place, or the retention limits in each.
How Sted helps
- For the ISO 27001 Annex A technological controls Sted’s knowledge base carries policies including the Access Control Policy (POL-ACC), Password and Authentication Policy (POL-PAP), Malware Protection Policy (POL-MPP), Configuration Management Policy (POL-CFG), Logging and Monitoring Policy (POL-LMP), Cryptography and Encryption Policy (POL-CRY), Backup Policy (POL-BCK), Network Security Policy (POL-NSP), Secure Software Development Policy (POL-SSDP) and Change Management Policy (POL-CHG), with record templates such as the Configuration Baseline Record (REC-CBR), Log Review Record (REC-LRR), Backup and Restore Test Record (REC-BRR), Network Rule Review Record (REC-NRR), Code Review and Security Test Record (REC-CRST) and Change Record (REC-CR).
- Records are part of the Full Management System plan.
- 33 periodic record types come with a suggested frequency, but nothing is scheduled until you pick a first due date.
- Sted does not connect to your cloud, code or HR systems to collect evidence automatically; you record it.
- Sted does not run penetration tests or scans; it records the result and tracks the actions.
Sted holds the policies and the records of your checks. It does not connect to or scan your systems; the evidence comes from your own tools and people.
Related guides and terms
- Access reviews: reviewing user and privileged access.
- Backup and restore testing: proving a restore meets your objectives.
- Cyber Essentials: where it overlaps with configuration, malware, patching, access and network controls.
- SOC 2: the criteria that cover much of the same ground for US customers.
- ISO 27002 and how it relates to ISO 27001: the detailed guidance and attributes for each control.
Frequently asked questions
Which Annex A technological controls are new in 2022?
Seven: configuration management (8.9), information deletion (8.10), data masking (8.11), data leakage prevention (8.12), monitoring activities (8.16), web filtering (8.23) and secure coding (8.28). Auditors ask about these most often in a first audit to the 2022 edition.
If we hold Cyber Essentials, which ISO 27001 technological controls does it cover?
It overlaps with several, mainly secure configuration, malware protection, vulnerability and patch management, user access and network boundary controls. It is evidence towards those controls, not a substitute for them, because ISO 27001 also asks for logging, monitoring, backup, secure development and the rest.