Home/ISO 27001/Annex A controls
The 93 controls, and the eleven that catch people out
There is no ISO 27001:2026. The current edition is still 2022, the 2013 edition stopped being valid in October 2025, and the part that decides how hard your audit will be is Annex A. Here is the whole of it, by theme, with the controls that did not exist before 2022.
The short answer
- ISO/IEC 27001:2022 is the current edition. There is no 2026 edition. Amendment 1 in 2024 added climate action considerations, and that is the only change since publication.
- The 2013 edition is gone. The transition ended on 31 October 2025, so a certificate against the old edition no longer counts for anything.
- Annex A holds 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological.
- Eleven controls are new since 2013, and they are the ones most first time applicants have no evidence for, because they cover cloud, threat intelligence, data leakage, secure coding and configuration management.
- You do not have to apply all 93. You have to decide about all 93, in a document called the Statement of Applicability, and justify every exclusion. That document is what the auditor reads first.
First, the edition
There is no ISO 27001:2026
This needs saying plainly, because the search results are full of pages promising a 2026 edition. There is not one. ISO/IEC 27001:2022 is the standard you certify against today, and the only change made to it since publication is Amendment 1 in 2024, which brought in climate action considerations in line with every other management system standard.
Three things cause the confusion, and all three are real documents, just not the one people think.
- ISO/IEC 27000 was revised in 2026. The sixth edition was published in July 2026. It is the overview and vocabulary document. It explains terms, it does not contain requirements, and you cannot be certified against it.
- ISO 27701 was republished in October 2025. The privacy information management standard became a standalone standard, so it no longer requires an ISO 27001 certificate underneath it. That is a genuine change, and it is a different standard.
- ISO 9001 was revised in 2026. That is the quality standard. Plenty of articles blur the two because both begin with ISO and both were in the news.
Meanwhile the 2013 edition really is finished. The transition deadline passed on 31 October 2025. If anyone offers you a certificate against ISO/IEC 27001:2013 today, walk away.
The structure
The 93 controls, by theme
The 2013 edition had 114 controls across 14 clauses. The 2022 edition reorganised them into 93 controls across four themes. Very little was actually deleted. Most of the reduction came from merging controls that had always been read together.
| Theme | Range | Controls | What it covers |
|---|---|---|---|
| Organisational | A.5.1 to A.5.37 | 37 | Policies, roles, supplier relationships, cloud services, incident management, continuity, legal and contractual requirements |
| People | A.6.1 to A.6.8 | 8 | Screening, terms of employment, awareness, disciplinary process, responsibilities after employment ends, remote working |
| Physical | A.7.1 to A.7.14 | 14 | Perimeters, entry, equipment siting, cabling, clear desk, secure disposal, monitoring of physical spaces |
| Technological | A.8.1 to A.8.34 | 34 | Access, cryptography, logging, malware, backup, development, configuration, data masking, web filtering |
The reorganisation is more useful than it looks. In the old structure, everything about a single supplier relationship was scattered across several clauses. In the new one, an auditor can follow one theme through an organisation and see whether it holds together.
The gap
The eleven controls that are new
These eleven did not exist in the 2013 edition. If your security documentation was written before 2022 and has been lightly updated since, this is almost certainly where the gaps are.
| Control | Name | What an auditor will look for |
|---|---|---|
| A.5.7 | Threat intelligence | Evidence that you collect and actually use information about threats relevant to you, not a subscription nobody reads |
| A.5.23 | Information security for use of cloud services | A process for selecting, using and exiting cloud services, with the shared responsibility understood in writing |
| A.5.30 | ICT readiness for business continuity | Recovery objectives tested against reality, not a plan that has never been exercised |
| A.7.4 | Physical security monitoring | Monitoring of premises for unauthorised access, and evidence somebody reviews what it records |
| A.8.9 | Configuration management | Defined secure baselines for systems, and detection of drift away from them |
| A.8.10 | Information deletion | Deletion when data is no longer needed, including in cloud services and backups |
| A.8.11 | Data masking | Masking or pseudonymisation where full data is not needed, typically in test environments |
| A.8.12 | Data leakage prevention | Measures on the channels where data actually leaves, chosen deliberately |
| A.8.16 | Monitoring activities | Networks and systems monitored for anomalous behaviour, with defined responses |
| A.8.23 | Web filtering | Control over access to external websites, with a documented rationale |
| A.8.28 | Secure coding | Secure coding principles applied in development, including code you buy or outsource |
Notice how many of them are about evidence of a running activity rather than a document. That is the real shift in the 2022 edition. A policy stating that you perform monitoring is not monitoring.
Work out your gap
Which new controls will apply to you
Tick what is true of your organisation. The tool shows which of the eleven new controls will be very hard to exclude from your Statement of Applicability, and therefore where you will need evidence.
Tick what applies
Tick a box to see which of the eleven new controls land on you.
Indicative only. Your Statement of Applicability is your own decision and your auditor will test the reasoning behind every exclusion.
Most organisations that run this find that eight or nine of the eleven apply. That is normal, and it is the honest starting point for a gap analysis.
A time saver
The five attributes, and why they save time
The 2022 edition tags every control with five attributes, defined in ISO/IEC 27002:2022. They are not requirements and you are not audited against them, which is exactly why most people ignore them. That is a mistake, because they let you slice the same 93 controls in whichever way the conversation needs.
- Control type. Preventive, detective or corrective. Useful when a board asks whether you can detect an incident or only prevent one.
- Information security property. Confidentiality, integrity or availability. Useful when a customer contract emphasises one of the three.
- Cybersecurity concept. Identify, protect, detect, respond, recover. This maps your controls onto the vocabulary most technical teams and insurers already use.
- Operational capability. Groups controls by the function that owns them, which is how you work out who is actually accountable.
- Security domain. A broader grouping for reporting.
In practice the cybersecurity concept attribute is the one that earns its keep. It turns an ISO 27001 Statement of Applicability into something a security team, an insurer and a customer questionnaire can all read without translation.
The document that decides everything
The Statement of Applicability
If you remember one document from this article, make it this one. The Statement of Applicability lists all 93 controls and records, for each, whether it applies, why, and where the evidence lives. It is the only document in the standard that forces a decision on every control.
- It sets the audit scope
- The auditor plans from it. Controls you say apply are controls you will be asked to evidence. Controls you exclude are exclusions you will be asked to justify.
- It exposes wishful thinking
- Excluding a control is a claim about your organisation. Saying secure coding does not apply while your team ships code is the fastest way to a major nonconformity.
- It is a living record
- It changes when the business changes. A new cloud service, a new office, a new development team, and the Statement of Applicability is out of date before the next surveillance audit.
A well built Statement of Applicability makes the rest of the project obvious, because it turns 93 abstract controls into a specific list of things your organisation has to be able to show.
Local reality
What companies here get wrong
Across the ISO 27001 projects we see in Pakistan, the same four patterns come up again and again.
- Buying documentation instead of building a system. A purchased template pack covers the paperwork and none of the evidence. The 2022 edition is heavily weighted toward evidence of activity, so this fails faster than it used to.
- Scoping too narrowly to make the audit easier. It works once. Then a customer asks why their data sits outside the certified scope, and the certificate stops being useful commercially.
- Treating cloud as somebody else’s problem. A.5.23 exists precisely because the provider secures the platform and you remain responsible for how you configure and use it.
- No internal auditor who understands the standard. Clause 9.2 requires internal audits, and an internal audit performed by someone who has never been trained is an audit in name only. This is the single most common gap we find.
The last one is worth dwelling on, because it is also the cheapest to fix. Our ISO 27001 lead auditor course covers the standard and the audit process, and if you only need to audit your own organisation, an internal auditor course is enough. The difference between the two is explained in our guide to what a lead auditor certificate actually proves.
The project
What getting certified actually involves
- Scope and context
- Decide what the certificate covers. Which entities, which locations, which services and which information. Get this wrong and everything downstream is wrong.
- Risk assessment
- Identify risks to your information and decide what to do about them. The controls follow from the risks, not the other way round.
- Statement of Applicability
- Decide about all 93 controls. Apply, exclude, justify, and point to where the evidence will live.
- Implementation
- Make the controls real. This is the long part, and the eleven new controls are usually where the work concentrates.
- Internal audit and management review
- Audit yourself before the certification body does. Clause 9.2 and clause 9.3. Both are mandatory and both are commonly rushed.
- Certification audit
- Stage one checks readiness, stage two checks implementation. Stage one is a genuine opportunity to find out what is missing while it is still cheap to fix.
Audit duration is set by the certification body using accreditation rules based on the number of people in scope and the complexity of what you do, which is why no honest consultant quotes a price before seeing your scope. We cover what actually moves the number in what ISO certification costs in Pakistan.
Questions
Frequently asked questions
Is there an ISO 27001:2026?
No. ISO/IEC 27001:2022 is the current edition, with Amendment 1 published in 2024 covering climate action. ISO/IEC 27000 was revised in 2026, but that is the vocabulary document and you cannot certify against it.
How many controls are in ISO 27001:2022?
93, arranged in four themes: 37 organisational, 8 people, 14 physical and 34 technological. The 2013 edition had 114 across 14 clauses, and most of the reduction came from merging related controls rather than removing requirements.
Do I have to implement all 93 controls?
No, but you have to make and record a decision about every one of them in your Statement of Applicability, and justify every exclusion. An exclusion that does not match how your organisation operates will be challenged at audit.
Which controls are new in the 2022 edition?
Eleven: threat intelligence, cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.
Can I still certify against ISO 27001:2013?
No. The transition from the 2013 edition ended on 31 October 2025. Only certificates based on the 2022 edition are valid now.
What are the five attributes?
Control type, information security property, cybersecurity concept, operational capability and security domain. They come from ISO/IEC 27002:2022, they are optional, and they are a reporting aid rather than a requirement.
Does ISO 27001 cover privacy and personal data?
Only indirectly. Privacy has its own standard, ISO 27701, which was republished in October 2025 as a standalone standard that no longer requires an ISO 27001 certificate underneath it.
Do we need a trained internal auditor?
Clause 9.2 requires internal audits, and the auditors have to be competent and objective. In practice that means trained, and it is the gap we find most often in organisations that otherwise have a good system.
Sources and further reading
- ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, with Amendment 1:2024.
- ISO/IEC 27002:2022 for the control guidance and the five attributes.
- ISO/IEC 27000, sixth edition, published July 2026, overview and vocabulary.
- ISO 27701, republished October 2025 as a standalone privacy information management standard.
- Transition from ISO/IEC 27001:2013 closed 31 October 2025.
Next step
Start with the Statement of Applicability
If you are deciding whether ISO 27001 is worth doing, the fastest way to find out is to walk the 93 controls against your own organisation and see how many you can already evidence. We do that as a gap analysis, and it tells you the size of the project before you commit to it.
Book a free consultationISO 27001 services
We work with businesses across Pakistan, including Lahore, Karachi and Islamabad.