You do not implement all 93
ISO 27001:2022 lists 93 Annex A controls across four themes. You are required to consider all 93 and justify which apply — not to implement every one.
This is the single most common misunderstanding about the standard, and it costs companies months. A control excluded with a documented justification is entirely legitimate. A control excluded because nobody assessed it is a nonconformity. The difference is written down in your Statement of Applicability.
The 2022 revision restructured Annex A from 114 controls in 14 domains into 93 across four themes, and added eleven genuinely new ones.
The four themes
| Theme | Controls | Character | Typical effort |
|---|---|---|---|
| Organizational | 37 | Policy, roles, supplier and incident management | Documentation-heavy |
| People | 8 | Screening, training, disciplinary and exit process | Low, but needs HR involvement |
| Physical | 14 | Facilities, equipment, media, clear desk | Often largely inherited from a cloud provider |
| Technological | 34 | Access, cryptography, logging, development, resilience | Where most engineering time lands |
Physical is where cloud-native companies find the most legitimate exclusions, because a great deal of it is performed by the cloud provider rather than by you. That is a justification, not a gap — but it has to be written down and it has to reference the provider control you are relying on.
Organizational controls (37)
The largest theme and the most documentation-heavy. Information security policies, roles and responsibilities, segregation of duties, management responsibilities, contact with authorities and special interest groups, threat intelligence, security in project management, asset inventory and acceptable use, information classification and labelling, access control policy, identity management, supplier relationships and their security, cloud service security, incident management and evidence collection, business continuity readiness, and legal and contractual compliance.
The one that catches people: supplier security. It sends you back through every vendor contract looking for security clauses that may not be there, and it depends on counterparties responding — the one part of an ISMS you cannot accelerate. Start it early.
People controls (8)
Screening before employment, terms and conditions of employment, awareness and training, the disciplinary process, responsibilities after termination or change of role, confidentiality agreements, remote working, and information security event reporting.
Small theme, disproportionate friction, because most of it lives with HR rather than with whoever owns the ISMS. Budget for the coordination, not the work.
Physical controls (14)
Physical perimeters and entry, securing offices and facilities, monitoring, protection against physical and environmental threats, working in secure areas, clear desk and clear screen, equipment siting and protection, off-premises assets, storage media, supporting utilities, cabling security, equipment maintenance, and secure disposal or reuse.
For a company running entirely on managed cloud infrastructure, a substantial portion of this theme is performed by the provider. Document which controls you are inheriting and from whom. Auditors accept inheritance readily; they do not accept silence.
Technological controls (34)
Where implementation effort concentrates. User endpoint devices, privileged access rights, information access restriction, source code access, secure authentication, capacity management, malware protection, technical vulnerability management, configuration management, information deletion, data masking, data leakage prevention, backup, redundancy, logging, monitoring activities, clock synchronisation, use of privileged utilities, software installation on operational systems, network security and segregation, web filtering, cryptography, secure development lifecycle, application security requirements, secure architecture, secure coding, security testing, outsourced development, separation of environments, change management, test information, and protection of audit systems.
The 2022 additions live mostly here, and they are the ones a 2013-era ISMS will not have: threat intelligence, cloud service security, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding.
How applicability is actually decided
Applicability follows from your risk assessment and your scope, in that order. The sequence matters:
1. Scope defines what the ISMS covers. 2. Risk assessment identifies what could go wrong within it. 3. Risk treatment decides what you will do. 4. The Statement of Applicability records which Annex A controls that implies, and justifies the rest.
Teams that start at step 4 — picking controls from the list — end up with an ISMS they cannot defend, because the auditor asks why a control applies and the honest answer is that it was on the list.
FAQs
Do I have to implement all 93 Annex A controls?
No. You must consider all 93 and justify which apply in your Statement of Applicability. A control excluded with a clear justification is entirely acceptable; a control excluded because nobody assessed it is a nonconformity. Which controls apply follows from your risk assessment and your ISMS scope.
How many Annex A controls are in ISO 27001:2022?
93, organised into four themes: 37 organizational, 8 people, 14 physical and 34 technological. The 2013 version had 114 controls across 14 domains, so the 2022 revision consolidated rather than expanded, while adding eleven genuinely new controls.
What are the new controls in ISO 27001:2022?
Eleven were added: threat intelligence, information security for cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding. An ISMS built against the 2013 version will not have these.
Can I exclude Annex A controls?
Yes, and most organizations do. The requirement is justification, not implementation. Cloud-native companies commonly exclude or inherit large parts of the physical theme because their provider performs those controls, which is legitimate as long as the inheritance is documented.
Which Annex A theme takes the most work?
Technological, with 34 controls covering access, cryptography, logging, development and resilience. Organizational is larger at 37 controls but is mostly documentation. Physical is often the smallest in practice for cloud-native companies because much of it is inherited.
Where to go next
Determine which controls apply to you with an ISO 27001 gap analysis, record the decisions in the Statement of Applicability, or see how an engagement runs in ISO 27001 consulting.