Information security · ISMS
ISO/IEC 27001:2022
Requirements for an information security management system: assessing information security risks, treating them with appropriate controls, and keeping the system effective. Annex A lists 93 reference controls in four themes.
1 What it covers
ISO/IEC 27001 is about managing information security risk in a structured way. The organisation decides what information and services are in scope, assesses risks to confidentiality, integrity and availability, chooses how to treat each risk, and produces a Statement of Applicability saying which Annex A controls apply and why.
The 2022 edition reorganised Annex A to match ISO/IEC 27002:2022 — 93 controls grouped into four themes — and added clause 6.3 Planning of changes.
2 Who uses it
IT and software companies, cloud and managed-service providers, financial services, healthcare, public bodies and their suppliers. It is one of the fastest-growing areas for auditor and implementer training.
3 Structure and key clauses
Clauses 4–10 follow the Harmonized Structure, with information-security specifics in clauses 6 and 8:
6 Planning
- 6.1.2 Information security risk assessment
- 6.1.3 Information security risk treatment (including the Statement of Applicability)
- 6.2 Information security objectives
- 6.3 Planning of changes
8 Operation
- 8.1 Operational planning and control
- 8.2 Information security risk assessment (performed at planned intervals)
- 8.3 Information security risk treatment
Annex A — reference controls
| Theme | Controls |
|---|---|
| A.5 Organizational | 37 |
| A.6 People | 8 |
| A.7 Physical | 14 |
| A.8 Technological | 34 |
| Total | 93 |
4 Key facts for courses and exams
- 93 Annex A controls in 4 themes (37 organizational, 8 people, 14 physical, 34 technological); the 2013 edition had 114.
- The Statement of Applicability records which controls are needed, whether they are implemented, and the justification for including or excluding each one.
- ISO/IEC 27002 gives guidance on implementing the controls; it is not itself certifiable.
- UK courses carry different certificates: CQI and IRCA, PECB, or IBITGQ (CIS LI / CIS LA).
5 ISO/IEC 27001 qualifications
6 Prepare
- ISO/IEC 27001:2022 information security practice quiz
S Sources
Facts on this page last checked 3 October 2026.
- iso.org, ISO/IEC 27001:2022 page — https://www.iso.org/standard/27001
- Annex A control counts — e.g. https://certpro.com/hub/iso-27001/controls/iso-27001-controls-list/