Skip to content

Join the hundreds of companies that trust 6clicks

qld-gov-logo

vic-gov-logo.png

nsw-gov-logo

Accel-IT-logo

TCS-logo-new

Melbourne-Racing-Club-logo

flybuys-logo

BDO-logo-resized-1

Trusted-Impact-Logo-resized

PS-Logo-nobg

ICT Legal - Favicon

riskcom-logo

EY-logo

devicedesk

Fisher-Leadership-logo

insync-logo1

Maddocks

KordaMentha_Logo

Picture1

Cyber security

‍What are the Annex A Controls?‍

Annex A of the ISO 27001 standard consists of a list of security controls organizations can utilize to improve the security of their information assets. ISO 27001 comprises 114 controls divided into 14 sections, also known as domains. The sections are focused on information technology and beyond, taking into consideration the wide range of factors that can impact the security of an organization’s information environment. The 14 ISO domains cover organizational issues, human resources, IT, physical security, and legal issues. Organizations are not required to implement the entire list of ISO 27001’s controls but instead use it as a list of possibilities to consider based on their unique needs. 

Utilizing the 114 controls listed in Annex A, a company can select those applicable to its needs and the needs of its customers. The 14 domains are:

  • Information security policies (A.5)
  • Organization of information security and assignment of responsibility (A.6)
  • Human resources security (A.7)
  • Asset management (A.8)
  • User access control (A.9)
  • Encryption and management of sensitive information (A.10)
  • Physical and environmental security (A.11)
  • Operational security (A.12)
  • Communications security (A.13)
  • System acquisition, development, and maintenance (A.14)
  • Supplier relationships (A.15)
  • Information security incident management (A.16)
  • Information security aspects of business continuity management (A.17)
  • Compliance (A.18)