How are the 93 controls organised?
| Theme | Annex A range | Number of controls | Examples |
|---|---|---|---|
| Organisational | 5.1–5.37 | 37 | Policies, roles, asset inventory, access control, supplier security, incident management, business continuity, compliance |
| People | 6.1–6.8 | 8 | Screening, terms of employment, awareness training, disciplinary process, remote working, event reporting |
| Physical | 7.1–7.14 | 14 | Perimeters, entry controls, clear desk, equipment siting, storage media, secure disposal |
| Technological | 8.1–8.34 | 34 | Endpoints, privileged access, malware protection, backups, logging, network security, cryptography, secure development |
Which controls are new in ISO 27001:2022?
- 5.7 Threat intelligence
- 5.23 Information security for use of cloud services
- 5.30 ICT readiness for business continuity
- 7.4 Physical security monitoring
- 8.9 Configuration management
- 8.10 Information deletion
- 8.11 Data masking
- 8.12 Data leakage prevention
- 8.16 Monitoring activities
- 8.23 Web filtering
- 8.28 Secure coding
What should each checklist entry contain?
- Applicability: included or excluded.
- Justification: the risk, legal, contractual or business reason for the decision.
- Implementation status: not started, in progress or implemented.
- Owner: the person accountable for the control.
- Evidence: the policy, configuration, record or log that proves it operates.
- Linked risks: the risks the control treats.
Which controls do auditors most often ask evidence for?
Experience from certification audits shows recurring evidence requests. Typical examples:
| Control | Typical evidence |
|---|---|
| 5.9 Inventory of information and assets | Asset register with owners |
| 5.15 / 8.2 Access control and privileged access | Access review records, list of admin accounts |
| 5.19–5.22 Supplier security | Supplier list with risk rating and review dates |
| 5.24–5.27 Incident management | Incident procedure and incident log |
| 6.3 Awareness training | Training completion records |
| 8.13 Information backup | Backup configuration and a restore-test log |
| 8.15 Logging | Log retention settings and a sample of reviewed logs |
| 8.32 Change management | Pull requests or tickets showing review and approval |
How do you use this checklist in ComplyPilot?
ComplyPilot (EU compliance platform) contains all 93 Annex A controls as structured records with applicability, justification, status, owner, linked risks and linked evidence. The Statement of Applicability is generated from those records, and readiness per theme updates as evidence is added.
What changed between ISO 27001:2013 and ISO 27001:2022?
The 2022 revision cut Annex A from 114 controls in 14 domains to 93 controls in 4 themes: organisational (37), people (8), physical (14) and technological (34). Most old controls were merged rather than removed, and 11 new controls were added.
The 11 new controls are threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. Certified organisations had until 31 October 2025 to move to the 2022 version.
Do you have to implement all 93 controls?
No. You must consider all 93 controls, but you only implement the ones your risk assessment calls for. The Statement of Applicability (SoA) lists every Annex A control, says whether it is included, and gives the reason for each inclusion or exclusion. Auditors look closely at exclusions, so each one needs a clear, risk-based reason.
How do you use this checklist in practice?
- Mark each control as applicable or not applicable, with a one-line reason.
- For applicable controls, record an owner and the current status.
- Link at least one piece of evidence that shows the control operating.
- Link each control to the risks it treats, so the SoA traces back to the risk assessment.
- Review the list at least once a year, and after major changes.
How does ComplyPilot help with the Annex A controls?
ComplyPilot (EU compliance platform) includes all 93 ISO/IEC 27001:2022 Annex A controls, grouped by theme. Each control has a status, owner, linked risks and linked evidence, and the Statement of Applicability is built from those records and can be exported as PDF or DOCX for the auditor.
Frequently asked questions
Can I exclude Annex A controls?
Yes, if the exclusion is justified in your Statement of Applicability — for example, physical controls for premises you do not operate. Auditors will check that the justification is reasonable.
Were any 2013 controls removed?
No control topic was dropped entirely; the 114 controls of the 2013 edition were merged and restructured into 93, and 11 new controls were added.