Anyone who learned ISO 27001 on the 2013 edition remembers Annex A as 14 domains, from A.5 information security policies to A.18 compliance, with 114 controls. The 2022 edition replaced that structure. There are now 93 controls in four themes, numbered to match the clauses of ISO/IEC 27002:2022, where the guidance for each control lives.
The change is easy to describe and easy to misread. The themes are a filing system, not a priority order or an org chart. A team that assigns each theme to one department ends up with gaps where the work crosses departments, which most of it does.
This article explains the four themes and what goes in each, lists the controls that are new in 2022, and covers the attributes ISO/IEC 27002 uses to give you other ways to sort the same controls.
Why there are four themes
ISO/IEC 27002:2022 sorts every control into one of four themes using a plain rule. A control is a people control if it concerns individual people, a physical control if it concerns physical objects, and a technological control if it concerns technology. Everything else is organizational.
That rule explains why the organizational theme is the largest. Policies, roles, supplier management, incident management, legal requirements, and business continuity are all decisions and processes the organization makes, rather than properties of a person, an object, or a system.
Annex A of ISO/IEC 27001 states each control in a sentence or two. ISO/IEC 27002 gives each control a purpose statement, guidance, and other information. The numbering is shared: control 8.5 in Annex A is control 8.5 in ISO/IEC 27002.
The four themes at a glance
| Theme | Annex A section | Controls | What it covers | Examples |
|---|---|---|---|---|
| Organizational | 5.1 to 5.37 | 37 | Governance, policy, roles, assets, access rules, suppliers, incidents, continuity, legal and compliance | 5.1 Policies for information security, 5.15 Access control, 5.19 Information security in supplier relationships |
| People | 6.1 to 6.8 | 8 | The employment lifecycle and individual responsibilities | 6.1 Screening, 6.3 Information security awareness, education and training, 6.7 Remote working |
| Physical | 7.1 to 7.14 | 14 | Premises, equipment, and media | 7.1 Physical security perimeters, 7.7 Clear desk and clear screen, 7.10 Storage media |
| Technological | 8.1 to 8.34 | 34 | Endpoints, identity, infrastructure, development, and monitoring | 8.5 Secure authentication, 8.13 Information backup, 8.15 Logging |
A few placements surprise people on first read.
Access control is split. 5.15 Access control (the rules) and 5.18 Access rights (provisioning, review, and removal) are organizational. 8.2 Privileged access rights and 8.5 Secure authentication are technological.
Incident management is organizational. Planning, assessment, response, learning, and evidence collection sit in 5.24 to 5.28, while 6.8 Information security event reporting is a people control, because it is about individuals reporting what they see.
Endpoint controls are technological. 8.1 User endpoint devices covers laptops and phones, while 7.9 Security of assets off-premises covers the physical side of the same devices outside the office.
The 11 new controls
Most 2022 controls are carried over or merged from 2013. Eleven have no direct 2013 predecessor:
5.7 Threat intelligence. Collecting and analyzing information about threats relevant to you, and using it in decisions.
5.23 Information security for use of cloud services. How you acquire, use, manage, and exit cloud services, under your own requirements.
5.30 ICT readiness for business continuity. Planning, testing, and maintaining the technology side of continuity, not only the business plan.
7.4 Physical security monitoring. Monitoring premises for unauthorized physical access.
8.9 Configuration management. Defining, documenting, and monitoring secure configurations for hardware, software, services, and networks.
8.10 Information deletion. Deleting information that is no longer required, in systems, devices, and storage media.
8.11 Data masking. Masking data, such as personal data, in line with your access control policy and legal requirements.
8.12 Data leakage prevention. Applying measures to systems, networks, and devices that process, store, or transmit sensitive information.
8.16 Monitoring activities. Monitoring networks, systems, and applications for anomalous behavior and acting on what you find.
8.23 Web filtering. Managing access to external websites to reduce exposure to malicious content.
8.28 Secure coding. Applying secure coding principles to software development.
Several of these describe work that many teams already do without naming it: configuration as code, a secure coding standard, an alerting pipeline. The gap is usually documentation and evidence, not the activity. Others, such as data masking and data leakage prevention, need a real decision about where they apply. Your risk assessment should drive that decision, and the clause 6 risk process explains how.
Attributes: other ways to sort the same controls
The themes give each control one home. ISO/IEC 27002:2022 also tags every control with attribute values, written as hashtags, so you can build other views. There are five attributes.
Control type:
#Preventive,#Detective,#Corrective.Information security properties:
#Confidentiality,#Integrity,#Availability.Cybersecurity concepts:
#Identify,#Protect,#Detect,#Respond,#Recover.Operational capabilities: 15 values, such as
#Asset_management,#Identity_and_access_management,#Secure_configuration, and#Continuity.Security domains: four values, such as
#Governance_and_Ecosystem,#Protection, and#Resilience.
Attributes are useful in three practical ways.
Assigning ownership. Filtering by operational capability gives a cleaner split of work than the themes do. Every control tagged
#Identity_and_access_managementgoes to whoever runs identity, regardless of whether it sits in clause 5 or clause 8.Checking balance. Filtering by control type shows whether your included controls lean heavily toward prevention, with too little that would detect or correct a failure.
Mapping to other frameworks. The cybersecurity concepts share their names with five of the six functions of NIST CSF 2.0, which helps when you explain coverage to a buyer who thinks in those terms.
Annex A of ISO/IEC 27002 explains how to use attributes and says organizations can create their own. Attributes are not requirements, and an auditor will not ask you to use them.
Reading the themes without being misled
Three misreadings come up often enough to name.
The themes are not a priority order. Organizational controls come first because of numbering, not importance. A missing backup control (8.13) is not less serious than a missing policy control (5.1).
Control counts are not a measure of effort. The physical theme has 14 controls, but for a company with no office and all infrastructure in the cloud, several of them carry little risk. The organizational theme's 37 controls include some of the heaviest work in the ISMS, such as supplier management and continuity.
Annex A is not a checklist. Clause 6.1.3 treats Annex A as a reference list to compare your chosen controls against, not a list you must implement in full. Every control still appears in your Statement of Applicability, either included with a reason or excluded with a reason.
Where to go from here
If you are building an ISMS for the first time, start from risks, not from the themes. What an ISMS is, in plain terms explains why. Then read Annex A once end to end, with ISO/IEC 27002 alongside it, before you decide what is included. The ISO 27001 framework page summarizes the standard, and the glossary defines terms such as control, theme, and Statement of Applicability.
How TrustLynce helps
TrustLynce maps each Annex A control to the evidence and policies behind it, and to equivalent requirements in other frameworks, through compliance automation. You can assign owners per control, so work that spans themes still has one accountable person.