They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
ISO 27001:2022 · Annex A Reference
All 93 Annex A Controls, Explained by Auditors
ISO 27001:2022 restructured Annex A into 93 controls across four themes — organizational, people, physical, and technological — including 11 controls that are entirely new. Every control below links to a full implementation guide: what it means, how to implement it, what auditors check, and where teams go wrong.
93ANNEX A CONTROLS
Organizational Controls (A.5.1 – A.5.37)
Governance, policy, supplier, incident, and continuity controls — the management layer of the ISMS.
A.5.1
Policies for information security
How to define, approve, publish, and review your information security policy and topic-specific policies — the governing documents of the ISMS.
A.5.2
Information security roles and responsibilities
Assigning and communicating ownership for every security duty in the ISMS, from the CISO to individual asset and risk owners.
A.5.3
Segregation of duties
Separating conflicting duties and areas of responsibility so no single person can initiate, approve, and conceal a sensitive action.
A.5.4
Management responsibilities
Making managers actively require their teams to apply security policies and procedures — visible enforcement, not passive endorsement.
A.5.5
Contact with authorities
Establishing and maintaining channels with regulators, law enforcement, and supervisory bodies for incident reporting and legal obligations.
A.5.6
Contact with special interest groups
Staying connected to security forums, CERTs, and professional communities for early warning, shared intelligence, and expertise.
A.5.7New in 2022
Threat intelligence
Collecting and analyzing threat information from internal and external sources and turning it into actionable defensive decisions.
A.5.8
Information security in project management
Embedding security requirements and risk assessment into every project lifecycle — not just IT projects.
A.5.9
Inventory of information and other associated assets
Building and maintaining an accurate inventory of information and supporting assets, each with a designated owner.
A.5.10
Acceptable use of information and other associated assets
Defining the rules for acceptable use and handling of information and assets, and making every user acknowledge them.
A.5.11
Return of assets
Ensuring employees and contractors return all organizational assets when their employment, contract, or agreement ends or changes.
A.5.12
Classification of information
Classifying information by confidentiality, integrity, and availability needs so protection effort matches business value.
A.5.13
Labelling of information
Applying classification labels to information across formats and systems so handling rules travel with the data.
A.5.14
Information transfer
Securing information in transit through transfer rules, agreements, and controls covering electronic, physical, and verbal channels.
A.5.15
Access control
Establishing the rules that govern who gets logical and physical access to what, based on business and security requirements.
A.5.16
Identity management
Managing the full lifecycle of identities — creation, change, deactivation — so every identity maps to one accountable entity.
A.5.17
Authentication information
Controlling how passwords, keys, and other authentication secrets are allocated, distributed, stored, and changed.
A.5.18
Access rights
Provisioning, reviewing, adjusting, and revoking access rights in line with the access control policy and joiner-mover-leaver events.
A.5.19
Information security in supplier relationships
Managing the security risks that come with suppliers accessing your information and systems, across the whole relationship lifecycle.
A.5.20
Addressing information security within supplier agreements
Writing security requirements — controls, SLAs, audit rights, breach duties — directly into supplier contracts.
A.5.21
Managing information security in the ICT supply chain
Extending security requirements beyond direct suppliers to the products, components, and sub-suppliers in the ICT supply chain.
A.5.22
Monitoring, review and change management of supplier services
Continuously monitoring supplier service delivery, reviewing performance, and managing changes to services and agreements.
A.5.23New in 2022
Information security for use of cloud services
Setting requirements for acquiring, using, managing, and exiting cloud services — shared responsibility made explicit.
A.5.24
Information security incident management planning and preparation
Building incident management capability before you need it: roles, procedures, communication channels, and competence.
A.5.25
Assessment and decision on information security events
Triage discipline: assessing security events against defined criteria and deciding which ones are actual incidents.
A.5.26
Response to information security incidents
Responding to incidents according to documented procedures — containment, eradication, recovery, escalation, and communication.
A.5.27
Learning from information security incidents
Converting incident experience into stronger controls, updated risk assessments, and sharper awareness.
A.5.28
Collection of evidence
Identifying, collecting, and preserving incident evidence so it remains intact and admissible for disciplinary, regulatory, or legal action.
A.5.29
Information security during disruption
Maintaining an appropriate level of information security when business is disrupted — security woven into continuity plans.
A.5.30New in 2022
ICT readiness for business continuity
Ensuring ICT can recover to meet business continuity objectives — RTOs, RPOs, failover, and tested recovery plans.
A.5.31
Legal, statutory, regulatory and contractual requirements
Identifying and keeping current every legal, regulatory, and contractual security obligation — and documenting how you satisfy each.
A.5.32
Intellectual property rights
Protecting intellectual property — yours and others’ — through licensing compliance, usage policies, and asset controls.
A.5.33
Protection of records
Protecting records against loss, destruction, falsification, and unauthorized access through their full retention lifecycle.
A.5.34
Privacy and protection of PII
Meeting privacy obligations for personal data — identification, protection, and lawful processing across every applicable law.
A.5.35
Independent review of information security
Having your security program independently reviewed at planned intervals and after significant change.
A.5.36
Compliance with policies, rules and standards for information security
Regularly verifying that security policies, rules, and standards are actually followed — and correcting deviations.
A.5.37
Documented operating procedures
Documenting operating procedures for security-relevant activities so they survive staff turnover and stand up in audits.
People Controls (A.6.1 – A.6.8)
Controls covering the human lifecycle: screening, contracts, awareness, discipline, remote work, and reporting.
A.6.1
Screening
Background verification proportionate to role risk — identity, employment history, qualifications — within legal and ethical limits.
A.6.2
Terms and conditions of employment
Embedding information security responsibilities into employment contracts and agreements before day one.
A.6.3
Information security awareness, education and training
Running a security awareness program that actually changes behavior — role-based, measured, and continuously refreshed.
A.6.4
Disciplinary process
A formal, communicated process for handling information security policy violations fairly and consistently.
A.6.5
Responsibilities after termination or change of employment
Defining which security duties — confidentiality, IP, data return — survive termination or role change, and enforcing them.
A.6.6
Confidentiality or non-disclosure agreements
Identifying, documenting, and regularly reviewing the confidentiality and NDA terms that protect your information.
A.6.7
Remote working
Securing information when people work from home or anywhere outside the office — devices, networks, and the physical environment.
A.6.8
Information security event reporting
Giving every person a clear, fast channel to report observed or suspected security events — and the culture to use it.
Physical Controls (A.7.1 – A.7.14)
Perimeters, entry, secure areas, equipment, media, and utilities — protecting information in physical space.
A.7.1
Physical security perimeters
Defining physical perimeters around areas holding information and assets, with barriers proportionate to the risk inside.
A.7.2
Physical entry
Controlling who enters secure areas — entry controls, visitor management, and protection of delivery and loading areas.
A.7.3
Securing offices, rooms and facilities
Designing and applying physical security for offices, rooms, and facilities against unauthorized access and observation.
A.7.4New in 2022
Physical security monitoring
Continuously monitoring premises with surveillance, intruder detection, and alarm response to detect unauthorized physical access.
A.7.5
Protecting against physical and environmental threats
Designing protection against fire, flood, earthquake, power events, and other physical or environmental threats to infrastructure.
A.7.6
Working in secure areas
Rules of conduct for working inside secure areas — supervision, device restrictions, and confidentiality of activities.
A.7.7
Clear desk and clear screen
Keeping sensitive material off desks and screens when unattended — simple rules that close the most common exposure gaps.
A.7.8
Equipment siting and protection
Siting equipment to reduce environmental threats, unauthorized access, and unintended observation of sensitive output.
A.7.9
Security of assets off-premises
Protecting devices and media used outside the office — custody, tracking, and protection wherever assets travel.
A.7.10
Storage media
Managing removable and fixed storage media through their lifecycle — acquisition, use, transport, and secure disposal.
A.7.11
Supporting utilities
Protecting operations from failures in power, cooling, telecom, and other supporting utilities — UPS, generators, and redundancy.
A.7.12
Cabling security
Protecting power and telecommunications cabling against interception, interference, and physical damage.
A.7.13
Equipment maintenance
Maintaining equipment correctly — authorized servicing, maintenance records, and security checks before equipment returns to use.
A.7.14
Secure disposal or re-use of equipment
Verifying storage media are sanitized or destroyed before equipment is disposed of or reused — no data walks out the door.
Technological Controls (A.8.1 – A.8.34)
Endpoint, access, cryptography, development, network, and monitoring controls — security in the technology stack.
A.8.1
User endpoint devices
Protecting laptops, phones, and other endpoint devices — hardening, encryption, MDM, and clear rules for BYOD.
A.8.2
Privileged access rights
Restricting and tightly managing admin-level access — allocation, PAM tooling, monitoring, and regular revalidation.
A.8.3
Information access restriction
Enforcing access to information per the access control policy — need-to-know by default, with dynamic restriction techniques.
A.8.4
Access to source code
Controlling read and write access to source code, development tools, and software libraries across the development estate.
A.8.5
Secure authentication
Implementing authentication strong enough for what it protects — MFA, secure log-on flows, and failure handling.
A.8.6
Capacity management
Monitoring and projecting compute, storage, network, and people capacity so availability never fails for predictable reasons.
A.8.7
Protection against malware
Layered malware defense: prevention, detection, and recovery controls, completed by the user awareness that makes them work.
A.8.8
Management of technical vulnerabilities
Identifying, evaluating, and remediating technical vulnerabilities — inventory-driven scanning, patching SLAs, and managed exceptions.
A.8.9New in 2022
Configuration management
Defining, enforcing, and monitoring secure baseline configurations for hardware, software, services, and networks.
A.8.10New in 2022
Information deletion
Deleting information when it is no longer required — in systems, devices, and cloud services — to limit exposure and meet retention law.
A.8.11New in 2022
Data masking
Masking, pseudonymizing, or anonymizing data so non-production and limited-privilege uses never expose the real thing.
A.8.12New in 2022
Data leakage prevention
Detecting and preventing unauthorized exfiltration of sensitive information across systems, networks, and endpoints.
A.8.13
Information backup
Maintaining and testing backups that match the agreed scope, frequency, and recovery objectives of the business.
A.8.14
Redundancy of information processing facilities
Building redundancy — components, systems, and sites — sufficient to meet the availability requirements you have committed to.
A.8.15
Logging
Producing, protecting, and analyzing event logs covering user activities, exceptions, faults, and security events.
A.8.16New in 2022
Monitoring activities
Monitoring networks, systems, and applications for anomalous behavior — and acting on what you find.
A.8.17
Clock synchronization
Synchronizing system clocks to approved time sources so logs correlate across systems and evidence holds up.
A.8.18
Use of privileged utility programs
Restricting and controlling utility programs capable of overriding system and application controls.
A.8.19
Installation of software on operational systems
Controlling what software gets installed on production systems, by whom, under what approval — and how it gets rolled back.
A.8.20
Networks security
Securing networks and network devices — protected management interfaces, traffic controls, and segregation-ready architecture.
A.8.21
Security of network services
Defining and enforcing security requirements for network services, in-house or outsourced — features, service levels, and monitoring.
A.8.22
Segregation of networks
Segregating groups of services, users, and systems into network domains with controlled traffic between them.
A.8.23New in 2022
Web filtering
Managing access to external websites to cut exposure to malicious content and enforce acceptable use.
A.8.24
Use of cryptography
Rules for effective cryptography: algorithm selection, key management, and lifecycle controls for data at rest and in transit.
A.8.25
Secure development life cycle
Building security into the software development lifecycle — rules applied from design through deployment.
A.8.26
Application security requirements
Identifying, specifying, and approving information security requirements when applications are developed or acquired.
A.8.27
Secure system architecture and engineering principles
Establishing secure-by-design engineering principles and applying them to every information system implementation.
A.8.28New in 2022
Secure coding
Applying secure coding principles — standards, tooling, and review — across in-house and third-party code.
A.8.29
Security testing in development and acceptance
Defining and executing security test plans in development pipelines and acceptance — SAST, DAST, and pre-release verification.
A.8.30
Outsourced development
Directing, monitoring, and reviewing outsourced software development so external code meets your security requirements.
A.8.31
Separation of development, test and production environments
Separating development, test, and production — environments, access, and data — to protect the live estate.
A.8.32
Change management
Putting changes to information systems and processing facilities through defined, recorded change control.
A.8.33
Test information
Selecting, protecting, and managing test data — production data never leaves production unprotected.
A.8.34
Protection of information systems during audit testing
Planning audits and technical tests so live systems stay protected — agreed scope, timing, and access.
Keep Exploring
Related Reading
ISO 27001
ISO 27001 Knowledge Hub
All 93 Annex A controls, all clauses, every guide in the cluster.
Read moreISO 27001
Annex A Controls Overview
All 93 controls across organizational, people, physical and tech domains.
Read moreISO 27001
ISO 27001 Clauses (4–10)
All 23 ISMS clauses explained — from context to continual improvement.
Read moreISO 27001
ISO 27001 Certification Guide
The step-by-step path from gap assessment to certificate.
Read moreISO 27001
ISO 27001 Implementation
The phased ISMS build, from scoping to surveillance audits.
Read moreFree Tool
SoA Builder
Draft an ISO 27001 Statement of Applicability across all 93 controls.
Read moreProof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Keep Exploring
Related Reading.
ISO 27001
ISO 27001 Knowledge Hub
All 93 Annex A controls, all clauses, every guide in the cluster.
Read moreISO 27001
Annex A Controls Overview
All 93 controls across organizational, people, physical and tech domains.
Read moreISO 27001
ISO 27001 Clauses (4–10)
All 23 ISMS clauses explained — from context to continual improvement.
Read moreISO 27001
ISO 27001 Certification Guide
The step-by-step path from gap assessment to certificate.
Read moreISO 27001
ISO 27001 Implementation
The phased ISMS build, from scoping to surveillance audits.
Read moreFree Tool
SoA Builder
Draft an ISO 27001 Statement of Applicability across all 93 controls.
Read more