Annex A - Information Security Controls

Annex A of ISO/IEC 27001:2022 lists the information-security controls that an ISMS can implement to treat identified risks. The annex groups 93 controls into four themes-organizational, people, physical and technological measures-and provides objectives and implementation guidance for each control. It serves as the baseline catalogue from which organizations select and tailor controls to meet their security requirements.