Framework

ISO/IEC 27001:2022

ISO/IEC 27001:2022 Annex A

93 requirements · 78 connected unified controls

Open ISO/IEC 27001:2022 in the map

Version: 2022
Published: 2022-10-25
Amendments: Amd 1:2024

Requirements and control mappings

“Full” and “Partial” describe the catalog mapping to a unified control. A partial mapping includes the remaining requirement. These mappings do not establish an organization’s implementation or certification.

Organizational controls

Requirement	Unified control and mapping
A.5.1Policies for information security	UC-GOV-14 — Establish and maintain approved security policies and proceduresPartial Remaining requirement: Policies must also be acknowledged by relevant personnel and interested parties
A.5.2Information security roles and responsibilities	UC-GOV-06 — Define security roles, responsibilities, and authoritiesFull
A.5.3Segregation of duties	UC-GOV-08 — Segregate conflicting duties and areas of responsibilityFull
A.5.4Management responsibilities	UC-GOV-07 — Hold individuals accountable for control responsibilitiesFull
A.5.5Contact with authorities	UC-GOV-23 — Maintain contacts with authorities and special interest groupsFull
A.5.6Contact with special interest groups	UC-GOV-23 — Maintain contacts with authorities and special interest groupsFull
A.5.7Threat intelligence	UC-RISK-17 — Operate threat intelligence and threat huntingFull
A.5.8Information security in project management	UC-RISK-02 — Integrate risk management into enterprise processes and projectsFull
A.5.9Inventory of information and other associated assets	UC-ASSET-01 — Maintain a complete inventory of systems, hardware, and softwarePartial Remaining requirement: inventorying information (data) assets themselves, addressed by the data-inventory control
A.5.10Acceptable use of information and other associated assets	UC-ASSET-06 — Govern acceptable use of endpoints, off-site, and external systemsFull
A.5.11Return of assets	UC-ASSET-07 — Manage assets through their life cycle and recover them at exitFull
A.5.12Classification of information	UC-ASSET-03 — Classify, prioritize, and label information and assetsFull
A.5.13Labelling of information	UC-ASSET-03 — Classify, prioritize, and label information and assetsFull
A.5.14Information transfer	UC-ASSET-08 — Transfer information securely under defined rules and agreementsFull
A.5.15Access control	UC-ACCESS-03 — Enforce least privilege, need-to-know, and segregation of dutiesPartial Remaining requirement: also requires rules controlling physical access to information and assets
A.5.16Identity management	UC-ACCESS-06 — Manage unique identities and identifiers end to endFull
A.5.17Authentication information	UC-ACCESS-08 — Manage and protect authenticators across their lifecyclePartial Remaining requirement: advising personnel on proper handling and protection of authentication information
A.5.18Access rights	UC-ACCESS-02 — Review user access rights periodicallyPartial Remaining requirement: provisioning, adjustment, and revocation satisfied by the account lifecycle control
A.5.19Information security in supplier relationships	UC-TPRM-01 — Operate a third-party security risk management programFull
A.5.20Addressing information security within supplier agreements	UC-HR-05 — Hold third-party personnel to equivalent security termsPartial Remaining requirement: broader supplier security terms addressed under third-party risk domain
A.5.21Managing information security in the ICT supply chain	UC-TPRM-07 — Verify component authenticity, provenance, and integrityPartial Remaining requirement: propagation of security requirements through the ICT supply chain via contract control
A.5.22Monitoring, review and change management of supplier services	UC-TPRM-04 — Monitor vendor performance, services, and riskFull
A.5.23Information security for use of cloud services	UC-TPRM-08 — Govern security of external and cloud service useFull
A.5.24Information security incident management planning and preparation	UC-IR-01 — Maintain an approved incident response planFull
A.5.25Assessment and decision on information security events	UC-IR-04 — Triage, categorize, and escalate reported security eventsFull
A.5.26Response to information security incidents	UC-IR-06 — Respond to, contain, and eradicate declared incidentsFull
A.5.27Learning from information security incidents	UC-IR-10 — Learn from incidents and communicate corrective actionsFull
A.5.28Collection of evidence	UC-IR-07 — Investigate incidents and preserve evidence and recordsFull
A.5.29Information security during disruption	UC-BCDR-01 — Maintain business continuity and disaster recovery plansFull
A.5.30ICT readiness for business continuity	UC-BCDR-01 — Maintain business continuity and disaster recovery plansPartial Remaining requirement: periodic ICT readiness testing satisfied by the testing control
A.5.31Legal, statutory, regulatory and contractual requirements	UC-GOV-03 — Identify and manage legal, regulatory, and contractual obligationsFull
A.5.32Intellectual property rights	UC-AUDIT-24 — Manage compliance with external legal and regulatory requirementsPartial Remaining requirement: operational IPR safeguards - license/asset registers with usage-vs-entitlement enforcement, proof-of-license retention, and acquisition from authorized sources - beyond registering and periodically evaluating the obligation
A.5.33Protection of records	UC-AUDIT-25 — Maintain quality records and information for internal controlFull
A.5.34Privacy and protection of personal identifiable information (PII)	UC-DATA-13 — Safeguard personal information with reasonable securityFull
A.5.35Independent review of information security	UC-AUDIT-23 — Coordinate independent assurance reviews across providersFull
A.5.36Compliance with policies, rules and standards for information security	UC-GOV-22 — Assess control effectiveness and authorize systemsFull
A.5.37Documented operating procedures	UC-GOV-14 — Establish and maintain approved security policies and proceduresFull

People controls

Requirement	Unified control and mapping
A.6.1Screening	UC-HR-01 — Screen personnel commensurate with position riskFull
A.6.2Terms and conditions of employment	UC-HR-02 — Formalize security responsibilities in employment termsFull
A.6.3Information security awareness, education and training	UC-TRAIN-01 — Deliver security awareness training to all personnelFull
A.6.4Disciplinary process	UC-HR-04 — Enforce a formal disciplinary process for violationsFull
A.6.5Responsibilities after termination or change of employment	UC-HR-03 — Secure termination and transfer of personnelFull
A.6.6Confidentiality or non-disclosure agreements	UC-HR-02 — Formalize security responsibilities in employment termsPartial Remaining requirement: NDAs from external/other interested parties, addressed by the third-party personnel control
A.6.7Remote working	UC-HR-07 — Secure remote working arrangementsFull
A.6.8Information security event reporting	UC-IR-03 — Provide channels to report events and obtain response helpFull

Physical controls

Requirement	Unified control and mapping
A.7.1Physical security perimeters	UC-PHYS-01 — Restrict physical access to facilities and secure areasFull
A.7.2Physical entry	UC-PHYS-01 — Restrict physical access to facilities and secure areasFull
A.7.3Securing offices, rooms and facilities	UC-PHYS-01 — Restrict physical access to facilities and secure areasFull
A.7.4Physical security monitoring	UC-PHYS-02 — Monitor physical access and retain visitor and entry recordsFull
A.7.5Protecting against physical and environmental threats	UC-PHYS-03 — Protect facilities against fire, water, and environmental hazardsFull
A.7.6Working in secure areas	UC-PHYS-01 — Restrict physical access to facilities and secure areasFull
A.7.7Clear desk and clear screen	UC-PHYS-09 — Prevent information exposure at desks, screens, and outputsFull
A.7.8Equipment siting and protection	UC-PHYS-04 — Site facilities and equipment to minimize hazards and exposureFull
A.7.9Security of assets off-premises	UC-ASSET-06 — Govern acceptable use of endpoints, off-site, and external systemsFull
A.7.10Storage media	UC-ASSET-04 — Control storage media through use, storage, and destructionFull
A.7.11Supporting utilities	UC-PHYS-05 — Provide emergency power, lighting, and resilient utilitiesFull
A.7.12Cabling security	UC-PHYS-06 — Protect power and communications cabling from damage and tapsFull
A.7.13Equipment maintenance	UC-PHYS-08 — Maintain equipment to preserve availability and integrityFull
A.7.14Secure disposal or re-use of equipment	UC-ASSET-04 — Control storage media through use, storage, and destructionFull

Technological controls

Requirement	Unified control and mapping
A.8.1User endpoint devices	UC-ASSET-06 — Govern acceptable use of endpoints, off-site, and external systemsFull
A.8.2Privileged access rights	UC-ACCESS-04 — Restrict privileged rights, utilities, and unauthorized softwareFull
A.8.3Information access restriction	UC-ACCESS-05 — Enforce approved authorizations for information and functionsFull
A.8.4Access to source code	UC-ACCESS-05 — Enforce approved authorizations for information and functionsFull
A.8.5Secure authentication	UC-ACCESS-09 — Authenticate all users with multi-factor authenticationFull
A.8.6Capacity management	UC-ACCESS-18 — Log and monitor system activity, capacity, and incidentsFull
A.8.7Protection against malware	UC-VULN-05 — Block malware, spam, and phishing across all systemsFull
A.8.8Management of technical vulnerabilities	UC-VULN-03 — Remediate identified flaws within defined timeframesPartial Remaining requirement: also requires obtaining vulnerability intelligence and evaluating exposure
A.8.9Configuration management	UC-CONFIG-01 — Harden systems to approved secure configuration baselinesFull
A.8.10Information deletion	UC-DATA-09 — Retain personal and confidential data per schedule, then destroy itFull
A.8.11Data masking	UC-DATA-12 — De-identify, mask, or pseudonymize personal dataFull
A.8.12Data leakage prevention	UC-DATA-11 — Control data flows, leakage, and cross-border transfersFull
A.8.13Information backup	UC-BCDR-03 — Back up data and verify restorabilityFull
A.8.14Redundancy of information processing facilities	UC-BCDR-04 — Provide redundant and alternate processing, storage, and telecomFull
A.8.15Logging	UC-LOG-01 — Log security-relevant events across all systemsPartial Remaining requirement: also requires protecting, storing, and analysing produced logs
A.8.16Monitoring activities	UC-LOG-04 — Continuously monitor systems for anomalous activityFull
A.8.17Clock synchronization	UC-LOG-02 — Record complete audit content with synchronized clocksFull
A.8.18Use of privileged utility programs	UC-ACCESS-04 — Restrict privileged rights, utilities, and unauthorized softwareFull
A.8.19Installation of software on operational systems	UC-CONFIG-05 — Permit only authorized software installation and useFull
A.8.20Networks security	UC-LOG-08 — Secure and monitor networks and network servicesFull
A.8.21Security of network services	UC-LOG-08 — Secure and monitor networks and network servicesFull
A.8.22Segregation of networks	UC-NET-01 — Segment networks and defend the external boundaryFull
A.8.23Web filtering	UC-NET-13 — Control mobile code and web contentFull
A.8.24Use of cryptography	UC-CRYPTO-02 — Use approved algorithms and validated cryptographic modulesPartial Remaining requirement: key management rules satisfied by the key lifecycle control
A.8.25Secure development life cycle	UC-SDLC-01 — Follow a secure development lifecycle with approval gatesFull
A.8.26Application security requirements	UC-SDLC-03 — Define and approve security requirements for applicationsFull
A.8.27Secure system architecture and engineering principles	UC-SDLC-04 — Engineer systems with secure architecture and designFull
A.8.28Secure coding	UC-SDLC-05 — Enforce secure coding and input validation standardsFull
A.8.29Security testing in development and acceptance	UC-VULN-04 — Test software security during development and acceptanceFull
A.8.30Outsourced development	UC-SDLC-10 — Oversee outsourced development and vet developersFull
A.8.31Separation of development, test and production environments	UC-CONFIG-03 — Separate environments and protect production data in testingFull
A.8.32Change management	UC-CONFIG-02 — Authorize, test, and approve changes before productionFull
A.8.33Test information	UC-CONFIG-03 — Separate environments and protect production data in testingFull
A.8.34Protection of information systems during audit testing	UC-SDLC-14 — Protect production systems during audit testingFull