# ISO/IEC 27001:2022 — Annex A (all 93 controls, four themes).
#
# This is exactly the list a Statement of Applicability enumerates. A control's
# full code is "ISO:<id>", matching the codes audit-report rulesets cite.
#
# COPYRIGHT: ISO/IEC 27001:2022 is copyright ISO/IEC. Only the Annex A control
# identifiers (e.g. A.5.17) and their short titles are reproduced here as labels;
# the normative control text and implementation guidance are not. For the
# authoritative wording, obtain the standard from ISO. These control-to-signal
# mappings are the maintainers' interpretation and are not reviewed or endorsed
# by ISO/IEC. See ../../MAPPING.md.
framework: ISO
name: ISO/IEC 27001:2022 Annex A
version: "2022"
coverage: complete
source: ISO/IEC 27001:2022 Annex A (identifiers and short titles only)
controls:
  # A.5 — Organizational controls
  - {id: A.5.1, family: Organizational, title: "Policies for information security."}
  - {id: A.5.2, family: Organizational, title: "Information security roles and responsibilities."}
  - {id: A.5.3, family: Organizational, title: "Segregation of duties."}
  - {id: A.5.4, family: Organizational, title: "Management responsibilities."}
  - {id: A.5.5, family: Organizational, title: "Contact with authorities."}
  - {id: A.5.6, family: Organizational, title: "Contact with special interest groups."}
  - {id: A.5.7, family: Organizational, title: "Threat intelligence."}
  - {id: A.5.8, family: Organizational, title: "Information security in project management."}
  - {id: A.5.9, family: Organizational, title: "Inventory of information and other associated assets."}
  - {id: A.5.10, family: Organizational, title: "Acceptable use of information and other associated assets."}
  - {id: A.5.11, family: Organizational, title: "Return of assets."}
  - {id: A.5.12, family: Organizational, title: "Classification of information."}
  - {id: A.5.13, family: Organizational, title: "Labelling of information."}
  - {id: A.5.14, family: Organizational, title: "Information transfer."}
  - {id: A.5.15, family: Organizational, title: "Access control."}
  - {id: A.5.16, family: Organizational, title: "Identity management."}
  - {id: A.5.17, family: Organizational, title: "Authentication information."}
  - {id: A.5.18, family: Organizational, title: "Access rights."}
  - {id: A.5.19, family: Organizational, title: "Information security in supplier relationships."}
  - {id: A.5.20, family: Organizational, title: "Addressing information security within supplier agreements."}
  - {id: A.5.21, family: Organizational, title: "Managing information security in the ICT supply chain."}
  - {id: A.5.22, family: Organizational, title: "Monitoring, review and change management of supplier services."}
  - {id: A.5.23, family: Organizational, title: "Information security for use of cloud services."}
  - {id: A.5.24, family: Organizational, title: "Information security incident management planning and preparation."}
  - {id: A.5.25, family: Organizational, title: "Assessment and decision on information security events."}
  - {id: A.5.26, family: Organizational, title: "Response to information security incidents."}
  - {id: A.5.27, family: Organizational, title: "Learning from information security incidents."}
  - {id: A.5.28, family: Organizational, title: "Collection of evidence."}
  - {id: A.5.29, family: Organizational, title: "Information security during disruption."}
  - {id: A.5.30, family: Organizational, title: "ICT readiness for business continuity."}
  - {id: A.5.31, family: Organizational, title: "Legal, statutory, regulatory and contractual requirements."}
  - {id: A.5.32, family: Organizational, title: "Intellectual property rights."}
  - {id: A.5.33, family: Organizational, title: "Protection of records."}
  - {id: A.5.34, family: Organizational, title: "Privacy and protection of personally identifiable information (PII)."}
  - {id: A.5.35, family: Organizational, title: "Independent review of information security."}
  - {id: A.5.36, family: Organizational, title: "Compliance with policies, rules and standards for information security."}
  - {id: A.5.37, family: Organizational, title: "Documented operating procedures."}
  # A.6 — People controls
  - {id: A.6.1, family: People, title: "Screening."}
  - {id: A.6.2, family: People, title: "Terms and conditions of employment."}
  - {id: A.6.3, family: People, title: "Information security awareness, education and training."}
  - {id: A.6.4, family: People, title: "Disciplinary process."}
  - {id: A.6.5, family: People, title: "Responsibilities after termination or change of employment."}
  - {id: A.6.6, family: People, title: "Confidentiality or non-disclosure agreements."}
  - {id: A.6.7, family: People, title: "Remote working."}
  - {id: A.6.8, family: People, title: "Information security event reporting."}
  # A.7 — Physical controls
  - {id: A.7.1, family: Physical, title: "Physical security perimeters."}
  - {id: A.7.2, family: Physical, title: "Physical entry."}
  - {id: A.7.3, family: Physical, title: "Securing offices, rooms and facilities."}
  - {id: A.7.4, family: Physical, title: "Physical security monitoring."}
  - {id: A.7.5, family: Physical, title: "Protecting against physical and environmental threats."}
  - {id: A.7.6, family: Physical, title: "Working in secure areas."}
  - {id: A.7.7, family: Physical, title: "Clear desk and clear screen."}
  - {id: A.7.8, family: Physical, title: "Equipment siting and protection."}
  - {id: A.7.9, family: Physical, title: "Security of assets off-premises."}
  - {id: A.7.10, family: Physical, title: "Storage media."}
  - {id: A.7.11, family: Physical, title: "Supporting utilities."}
  - {id: A.7.12, family: Physical, title: "Cabling security."}
  - {id: A.7.13, family: Physical, title: "Equipment maintenance."}
  - {id: A.7.14, family: Physical, title: "Secure disposal or re-use of equipment."}
  # A.8 — Technological controls
  - {id: A.8.1, family: Technological, title: "User endpoint devices."}
  - {id: A.8.2, family: Technological, title: "Privileged access rights."}
  - {id: A.8.3, family: Technological, title: "Information access restriction."}
  - {id: A.8.4, family: Technological, title: "Access to source code."}
  - {id: A.8.5, family: Technological, title: "Secure authentication."}
  - {id: A.8.6, family: Technological, title: "Capacity management."}
  - {id: A.8.7, family: Technological, title: "Protection against malware."}
  - {id: A.8.8, family: Technological, title: "Management of technical vulnerabilities."}
  - {id: A.8.9, family: Technological, title: "Configuration management."}
  - {id: A.8.10, family: Technological, title: "Information deletion."}
  - {id: A.8.11, family: Technological, title: "Data masking."}
  - {id: A.8.12, family: Technological, title: "Data leakage prevention."}
  - {id: A.8.13, family: Technological, title: "Information backup."}
  - {id: A.8.14, family: Technological, title: "Redundancy of information processing facilities."}
  - {id: A.8.15, family: Technological, title: "Logging."}
  - {id: A.8.16, family: Technological, title: "Monitoring activities."}
  - {id: A.8.17, family: Technological, title: "Clock synchronization."}
  - {id: A.8.18, family: Technological, title: "Use of privileged utility programs."}
  - {id: A.8.19, family: Technological, title: "Installation of software on operational systems."}
  - {id: A.8.20, family: Technological, title: "Networks security."}
  - {id: A.8.21, family: Technological, title: "Security of network services."}
  - {id: A.8.22, family: Technological, title: "Segregation of networks."}
  - {id: A.8.23, family: Technological, title: "Web filtering."}
  - {id: A.8.24, family: Technological, title: "Use of cryptography."}
  - {id: A.8.25, family: Technological, title: "Secure development life cycle."}
  - {id: A.8.26, family: Technological, title: "Application security requirements."}
  - {id: A.8.27, family: Technological, title: "Secure system architecture and engineering principles."}
  - {id: A.8.28, family: Technological, title: "Secure coding."}
  - {id: A.8.29, family: Technological, title: "Security testing in development and acceptance."}
  - {id: A.8.30, family: Technological, title: "Outsourced development."}
  - {id: A.8.31, family: Technological, title: "Separation of development, test and production environments."}
  - {id: A.8.32, family: Technological, title: "Change management."}
  - {id: A.8.33, family: Technological, title: "Test information."}
  - {id: A.8.34, family: Technological, title: "Protection of information systems during audit testing."}