Every ISO 27001 clause and all 93 controls, in plain English
Seven clauses you must meet and 93 Annex A controls you choose from. Browse them by theme or search.
The seven clauses (4 to 10)
These are required for certification. Nothing here can be left out.
Clause 4: Context of the organization
Understand your business and decide what the security system covers.
- 4.1 Identify the internal and external issues that affect your security.
- 4.2 Identify who has expectations of you, such as customers, regulators and staff.
- 4.3 Define and write down the scope of the system.
- 4.4 Set up, run and improve the system itself.
Clause 5: Leadership
Management owns security. It is not left to IT alone.
- 5.1 Management shows commitment and provides the resources.
- 5.2 Management approves a written security policy.
- 5.3 Roles, responsibilities and authority are assigned.
Clause 6: Planning
Work out your risks, choose your controls, and set goals.
- 6.1 Assess risks, decide how to treat each one, compare your controls with Annex A and record the result in a Statement of Applicability.
- 6.2 Set security objectives and plan how to reach them.
- 6.3 Plan changes to the system in a controlled way.
Clause 7: Support
Give the system the people, skills and paperwork it needs.
- 7.1 Provide the resources the system needs.
- 7.2 Make sure people are competent for their security roles.
- 7.3 Make people aware of the policy and their part in it.
- 7.4 Decide what is communicated, to whom and when.
- 7.5 Create and control the documents and records the system needs.
Clause 8: Operation
Carry out what you planned.
- 8.1 Run the processes you planned and control changes to them.
- 8.2 Carry out risk assessments at planned intervals and when things change.
- 8.3 Carry out the risk treatment plan and keep the results.
Clause 9: Performance evaluation
Check that it works.
- 9.1 Monitor, measure and analyse how the system performs.
- 9.2 Run internal audits at planned intervals.
- 9.3 Management reviews the system at planned intervals.
Clause 10: Improvement
Fix what is wrong and keep getting better.
- 10.1 Continually improve the suitability and effectiveness of the system.
- 10.2 When something goes wrong, fix it, find the cause and prevent it recurring.
The 93 Annex A controls
You choose the controls that fit your risks and record the ones you leave out, with reasons.
Organizational
37 controls · 5.1 to 5.37
Policies, roles, assets, access, suppliers, incidents, continuity and legal duties.
People
8 controls · 6.1 to 6.8
Hiring, training, agreements, remote work and reporting.
Physical
14 controls · 7.1 to 7.14
Premises, equipment, media, utilities and disposal.
Technological
34 controls · 8.1 to 8.34
Devices, access, malware, backup, logging, networks, encryption and secure development.
93 controls
Policies for information security
Write, approve and publish security policies, and review them on a schedule.
Information security roles and responsibilities
Name who is responsible for what in security.
Segregation of duties
Split conflicting tasks so no one person can misuse a critical process alone.
Management responsibilities
Managers make sure their teams follow the security rules.
Contact with authorities
Know who to contact, such as regulators or police, and when.
Contact with special interest groups
Stay connected to security communities and professional groups.
Threat intelligenceNew in 2022
Collect and use information about current threats to your business.
Information security in project management
Build security into projects from the start.
Inventory of information and other associated assets
Keep a list of information and assets, each with an owner.
Acceptable use of information and other associated assets
Set clear rules for how people may use information and equipment.
Return of assets
Make sure people hand back assets when they leave or change roles.
Classification of information
Sort information by sensitivity, such as public, internal or confidential.
Labelling of information
Mark information so people know how to handle it.
Information transfer
Protect information when it is sent by email, file transfer or in person.
Access control
Decide who can access what, based on business need.
Identity management
Manage the full life of each user identity, from creation to removal.
Authentication information
Control passwords and other secrets, and teach people to protect them.
Access rights
Grant, review and remove access in a controlled way.
Information security in supplier relationships
Manage the security risks that suppliers bring.
Addressing information security within supplier agreements
Put security requirements into supplier contracts.
Managing information security in the ICT supply chain
Manage security risks across the chain of technology suppliers.
Monitoring, review and change management of supplier services
Keep checking that suppliers deliver the security they promised.
Information security for use of cloud servicesNew in 2022
Set rules for choosing, using and leaving cloud services.
Information security incident management planning and preparation
Plan how you will handle incidents before they happen.
Assessment and decision on information security events
Decide quickly whether an event is a real incident.
Response to information security incidents
Respond to incidents using your documented procedure.
Learning from information security incidents
Use incidents to improve your controls.
Collection of evidence
Preserve evidence properly when an incident may need investigation.
Information security during disruption
Keep security in place during a disruption.
ICT readiness for business continuityNew in 2022
Make sure technology can recover to meet business continuity goals.
Legal, statutory, regulatory and contractual requirements
Know the laws and contracts that affect your security and follow them.
Intellectual property rights
Respect licences and protect your own intellectual property.
Protection of records
Protect important records from loss, damage and tampering.
Privacy and protection of PII
Protect personal data as the law and your contracts require.
Independent review of information security
Have someone independent review your security approach.
Compliance with policies, rules and standards for information security
Check regularly that people follow your policies.
Documented operating procedures
Write down how important operational tasks are done.
Screening
Check the background of candidates in proportion to the role.
Terms and conditions of employment
Put security duties into employment agreements.
Information security awareness, education and training
Train staff on security regularly.
Disciplinary process
Have a fair, known process for security breaches by staff.
Responsibilities after termination or change of employment
Spell out security duties that continue after someone leaves or changes role.
Confidentiality or non-disclosure agreements
Use NDAs with staff and others who see sensitive information.
Remote working
Protect information when people work away from the office.
Information security event reporting
Give people an easy way to report suspected security events.
Physical security perimeters
Define and protect areas that hold sensitive information or systems.
Physical entry
Control who can enter, and record visitors.
Securing offices, rooms and facilities
Secure the rooms and buildings that hold your assets.
Physical security monitoringNew in 2022
Watch premises for unauthorised access, for example with cameras or alarms.
Protecting against physical and environmental threats
Guard against fire, flood and similar threats.
Working in secure areas
Set rules for working inside protected areas.
Clear desk and clear screen
Do not leave sensitive material on desks or screens.
Equipment siting and protection
Place equipment where it is safe from damage and prying eyes.
Security of assets off-premises
Protect equipment that leaves the office.
Storage media
Manage USB drives, disks and other media through their life.
Supporting utilities
Protect equipment from power and utility failures.
Cabling security
Protect power and network cabling from damage and tapping.
Equipment maintenance
Maintain equipment so it stays available and intact.
Secure disposal or re-use of equipment
Wipe data before equipment is discarded or reused.
User endpoint devices
Protect laptops, phones and other devices people use.
Privileged access rights
Tightly control and monitor administrator-level access.
Information access restriction
Limit access to information according to your access rules.
Access to source code
Control who can read and change source code.
Secure authentication
Use strong sign-in methods, such as multi-factor authentication, for sensitive systems.
Capacity management
Monitor and plan capacity so systems keep running.
Protection against malware
Detect and block malicious software and train users.
Management of technical vulnerabilities
Find and fix weaknesses in systems on a regular basis.
Configuration managementNew in 2022
Set, document and monitor secure configurations.
Information deletionNew in 2022
Delete information when it is no longer needed.
Data maskingNew in 2022
Hide parts of sensitive data where full data is not needed.
Data leakage preventionNew in 2022
Detect and stop sensitive data leaving your control.
Information backup
Take backups and test that you can restore them.
Redundancy of information processing facilities
Build in spare capacity so a single failure does not stop service.
Logging
Record activity so you can investigate later.
Monitoring activitiesNew in 2022
Watch systems and networks for unusual behaviour.
Clock synchronization
Keep system clocks aligned so logs can be trusted.
Use of privileged utility programs
Restrict powerful tools that can bypass normal controls.
Installation of software on operational systems
Control what software goes onto production systems.
Networks security
Secure networks and the devices on them.
Security of network services
Define security requirements for network services you use.
Segregation of networks
Separate networks so a problem in one stays contained.
Web filteringNew in 2022
Block access to harmful websites.
Use of cryptography
Use encryption and manage keys properly.
Secure development life cycle
Build security into each stage of software development.
Application security requirements
Define security needs when building or buying applications.
Secure system architecture and engineering principles
Apply sound security design principles to systems.
Secure codingNew in 2022
Follow secure coding practices.
Security testing in development and acceptance
Test security before software goes live.
Outsourced development
Oversee the security of development done by others.
Separation of development, test and production environments
Keep these environments apart.
Change management
Control changes to systems and processes.
Test information
Choose and protect data used for testing.
Protection of information systems during audit testing
Plan audit tests so they do not disrupt live systems.
The 2022 changes in one minute
The 2013 edition had 114 controls in 14 domains. The 2022 edition has 93 controls in four themes. Many were merged, 11 are new (such as threat intelligence, cloud services security and data leakage prevention), and the controls gained attributes to make them easier to filter. The transition from the 2013 edition ended on 31 October 2025.
Back to the ISO 27001 overview →See how ready you are for ISO 27001
Answer questions across every clause and control theme. We email you a report showing where you comply and where you do not.