My Account

Hello, Sign in

Sign up now and enjoy discounted shopping!

Log In

New Customer? Sign Up

$0.00

No products in the cart.

No products in the cart.

ISO 27001 Annex A Controls

95

Understanding the ISO 27001 Structure
ISO/IEC 27001 Step-by-Step Implementation Guide
A5.1: Policies for Information Security
A5.2: Information Security Roles and Responsibilities
A5.3: Segregation of Duties
A5.4: Management Responsibilities
A5.5: Contact with Authorities
A5.6: Contact with Special Interest Groups
A5.7: Threat Intelligence
A5.8: Information Security in Project Management
A5.9: Inventory of Information and Other Associated Assets
A5.10: Acceptable Use of Information and Other Associated Assets
A5.11: Return of Assets
A5.12: Classification of Information
A5.13: Labelling of Information
A5.14: Information Transfer
A5.15: Access Control
A5.16: Identity Management
A5.17: Authentication Information
A5.18: Access Rights
A5.19 Information security in supplier relationships
A5.20 Addressing information security within supplier agreements
A5.21 Managing information security in the information and communication technology (ICT) supply chain
A5.22 Monitoring, review and change management of supplier services
A5.23 Information security for use of cloud services
A5.24 Information security incident management planning and preparation
A5.25 Assessment and decision on information security events
A5.26 Response to information security incidents
A5.27 Learning from information security incidents
A5.28 Collection of evidence
A5.29 Information security during disruption
A5.30 ICT readiness for business continuity
A5.31 Legal, statutory, regulatory and contractual requirements
A5.32 Intellectual property rights
A5.33 Protection of records
A5.34 Privacy and protection of personal identifiable information (PII)
A5.35 Independent review of information security
A5.36 Compliance with policies, rules and standards for information security
A5.37 Documented operating procedures
A6.1 Screening
A6.2 Terms and conditions of employment
A6.3 Information security awareness, education and training
A6.4 Disciplinary Process
A6.5 Responsibilities after termination or change of employment
A6.6 Confidentiality or non-disclosure agreements
A6.7 Remote working
A6.8 Information security event reporting
A7.1 Physical security Perimeter
A7.2 Physical entry
A7.3 Securing offices, rooms and facilities
A7.4 Physical security monitoring
A7.5 Protecting against physical and environmental threats
A7.6 Working in secure areas
A7.7 Clear desk and clear screen
A7.8 Equipment siting and protection
A7.9 Security of assets off-premises
A7.10 Storage media
A7.11 Supporting utilities
A7.12 Cabling security
A7.13 Equipment maintenance
A7.14 Secure disposal or re-use of equipment
A8.1 User end point devices
A8.2 Privileged access rights
A8.3 Information access restriction
A8.4 Access to source code
A8.5 Secure authentication
A8.6 Capacity management
A8.7 Protection against malware
A8.8 Management of technical vulnerabilities
A8.9 Configuration management
A8.10 Information Deletion
A8.11 Data masking
A8.12 Data leakage prevention
A8.13 Information backup
A8.14 Redundancy of information processing facilities
A8.15 Logging
A8.16 Monitoring activities
A8.17 Clock synchronization
A8.18 Use of privileged utility programs
A8.19 Installation of software on operational systems
A8.20 Networks security
A8.21 Security of network services
A8.22 Segregation of networks
A8.23 Web filtering
A8.24 Use of cryptography
A8.25 Secure development life cycle
A8.26 Application security requirements
A8.27 Secure system architecture and engineering principles
A8.28 Secure coding
A8.29 Security testing in development and acceptance
A8.30 Outsourced development
A8.31 Separation of development, test and production environments
A8.32 Change management
A8.33 Test information
A8.34 Protection of information systems during audit testing

What is ISO 27001

3

Introduction to ISO/IEC 27001:2022
Understanding the ISO 27001 Structure
ISO/IEC 27001 Step-by-Step Implementation Guide

ISO 27001 A.5 Organizational Controls

37

A5.1: Policies for Information Security
A5.2: Information Security Roles and Responsibilities
A5.3: Segregation of Duties
A5.5: Contact with Authorities
A5.6: Contact with Special Interest Groups
A5.7: Threat Intelligence
A5.8: Information Security in Project Management
A5.9: Inventory of Information and Other Associated Assets
A5.10: Acceptable Use of Information and Other Associated Assets
A5.11: Return of Assets
A5.12: Classification of Information
A5.13: Labelling of Information
A5.14: Information Transfer
A5.15: Access Control
A5.16: Identity Management
A5.17: Authentication Information
A5.18: Access Rights
A5.19 Information security in supplier relationships
A5.20 Addressing information security within supplier agreements
A5.21 Managing information security in the information and communication technology (ICT) supply chain
A5.22 Monitoring, review and change management of supplier services
A5.23 Information security for use of cloud services
A5.24 Information security incident management planning and preparation
A5.25 Assessment and decision on information security events
A5.26 Response to information security incidents
A5.27 Learning from information security incidents
A5.28 Collection of evidence
A5.29 Information security during disruption
A5.30 ICT readiness for business continuity
A5.31 Legal, statutory, regulatory and contractual requirements
A5.32 Intellectual property rights
A5.33 Protection of records
A5.34 Privacy and protection of personal identifiable information (PII)
A5.35 Independent review of information security
A5.36 Compliance with policies, rules and standards for information security
A5.37 Documented operating procedures
A.5 Organizational Controls

ISO 27001 A.6 People Controls

9

A6.1 Screening
A6.2 Terms and conditions of employment
A6.3 Information security awareness, education and training
A6.4 Disciplinary Process
A6.5 Responsibilities after termination or change of employment
A6.6 Confidentiality or non-disclosure agreements
A6.7 Remote working
A6.8 Information security event reporting
A.6 People Controls

ISO 27001 A.7 Physical Controls

15

A7.1 Physical security Perimeter
A7.2 Physical entry
A7.3 Securing offices, rooms and facilities
A7.4 Physical security monitoring
A7.5 Protecting against physical and environmental threats
A7.6 Working in secure areas
A7.7 Clear desk and clear screen
A7.8 Equipment siting and protection
A7.9 Security of assets off-premises
A7.10 Storage media
A7.11 Supporting utilities
A7.12 Cabling security
A7.13 Equipment maintenance
A7.14 Secure disposal or re-use of equipment
A.7 Physical Controls

ISO 27001 A.8 Technological Controls

35

A8.1 User end point devices
A8.2 Privileged access rights
A8.3 Information access restriction
A8.4 Access to source code
A8.5 Secure authentication
A8.6 Capacity management
A8.7 Protection against malware
A8.8 Management of technical vulnerabilities
A8.9 Configuration management
A8.10 Information Deletion
A8.11 Data masking
A8.12 Data leakage prevention
A8.13 Information backup
A8.14 Redundancy of information processing facilities
A8.15 Logging
A8.16 Monitoring activities
A8.17 Clock synchronization
A8.18 Use of privileged utility programs
A8.19 Installation of software on operational systems
A8.20 Networks security
A8.21 Security of network services
A8.22 Segregation of networks
A8.23 Web filtering
A8.24 Use of cryptography
A8.25 Secure development life cycle
A8.26 Application security requirements
A8.27 Secure system architecture and engineering principles
A8.28 Secure coding
A8.29 Security testing in development and acceptance
A8.30 Outsourced development
A8.31 Separation of development, test and production environments
A8.32 Change management
A8.33 Test information
A8.34 Protection of information systems during audit testing
ISO 27001 A.8 Technological Controls

View Categories

Home
Docs
ISO 27001 A.5 Organizational Controls

A.5 Organizational Controls

< 1 min read

What are your Feelings

Share This Article :

Still stuck? How can we help?

Still stuck? How can we help?

Name: *

Email: *

Message: *

A5.37 Documented operating procedures A5.1: Policies for Information Security

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Comment *

Name *

Email *

Website

Save my name, email, and website in this browser for the next time I comment.

ISO 27001 Pro LLC provides expert toolkits and resources that simplify and accelerate the path to ISO/IEC 27001 certification.

Useful Links

About Us
Free Resources
Learn ISO 27001
Courses
Read Posts

Agreements with you

Privacy Policy
Terms & Conditions
Cokie Policy
Refund & Return Policy
Delivery Policy

Connect with Us

MR SHAPON
Facebook
LinkedIn
Instagram
Contac Us

Copyright 2026 © ISO 27001 PRO LLC. All right reserved.

payment

app

Store
Search
Wishlist
Account

Log in

Username or email address *

Password *

Remember me

Lost your password?

By continuing, you accept the Website Regulations , Regulations for the sale of alcoholic beverages and the Privacy Policy

You dont have an account yet? Register Now

Main Menu

TEMPLATES
RESOURCES
MORE

Category Menu

Copyright 2026 © ISO 27001 PRO LLC. All right reserved.