ISO 27001 Controls Checklist: The 2026 Guide to Annex A Compliance

As of July 2026, every ISO 27001:2013 certification has officially expired, which means your organization must now demonstrate full compliance with the 2022 framework and the mandatory 2024 climate action amendment. Successfully navigating this transition requires a precise iso 27001 controls checklist that accounts for the consolidation from 114 to 93 controls. You’re likely concerned about the precision of your Statement of Applicability and whether your technical evidence will withstand the scrutiny of a rigorous third-party audit.

This guide provides a definitive, decision-focused breakdown designed to move you beyond checkbox security toward a model of thematic evidence. We’ll analyze the 93 controls across organizational, people, physical, and technological themes to help you achieve certification with confidence. By following this structured approach, you can ensure your documentation meets the exact requirements of international standards while enhancing global stakeholder trust and supporting your international growth.

The Modern ISO 27001:2022 Control Framework

Annex A represents the foundational reference set of security controls employed to treat identified risks within an Information Security Management System (ISMS). In the context of ISO/IEC 27001, these controls aren’t merely suggestions; they’re the benchmarks against which your organization is measured during a certification audit. The 2022 update introduced a streamlined structure, consolidating the previous 114 controls into 93. This revision was designed to eliminate redundancy and align security practices with the modern technological landscape, specifically focusing on cloud environments and evolving cyber threats.

This shift matters because it moves your compliance efforts away from administrative silos toward a holistic, risk-based management approach. Rather than treating physical security and digital encryption as separate entities, the 2022 framework encourages cross-functional oversight. Every organization seeking certification must produce a Statement of Applicability (SoA). This document functions as your primary iso 27001 controls checklist, justifying why specific controls were selected or excluded based on your unique risk profile. It’s the central document that auditors review to understand your security posture.

The Four Control Themes Explained

The 93 controls are categorized into four themes, which simplifies the assignment of responsibility within an organization. This thematic structure allows for more efficient evidence gathering during the audit process.

• Organisational Controls (37): These controls focus on the bedrock of the ISMS, including high-level policies, asset management, and the governance of cloud service usage.
• People Controls (8): This theme addresses human-centric risks. It includes requirements for remote working security, employee screening, and the enforcement of confidentiality agreements.
• Physical Controls (14): These protect the hardware and premises where data is processed. They cover secure areas, physical entry controls, and the maintenance of equipment.
• Technological Controls (34): These are the digital safeguards implemented within your IT infrastructure. Key areas include encryption, secure coding practices, and network security management.

Transitioning from ISO 27001:2013 to 2022

The transition period for moving from the 2013 version to the 2022 standard concluded on October 31, 2025. Consequently, any organization currently holding an expired 2013 certificate must undergo a full initial audit to the new standard. When updating your ISMS, you must identify merged controls to prevent redundant documentation. For instance, several previous controls regarding logging and monitoring have been combined to improve clarity.

You must also integrate the 11 entirely new controls. These include ‘Threat Intelligence’, ‘Information Deletion’, and ‘Data Masking’, which reflect contemporary data privacy and cybersecurity requirements. Ensuring your management system certification reflects these updates is critical for maintaining global reliability and stakeholder trust. Your iso 27001 controls checklist should be updated to reflect these 93 controls to ensure no gaps exist before your next formal assessment.

Organisational and People Controls Checklist

Organisational controls represent the structural framework of any Information Security Management System (ISMS). While technological safeguards are necessary, they often fail if the underlying governance isn’t robust. People controls address the most persistent vulnerability in any security architecture: human error and insider threats. In 2026, auditors prioritize evidence of a “living” security culture over static files created solely for the purpose of a certification visit. Your iso 27001 controls checklist must therefore reflect active, ongoing processes rather than one-off administrative tasks.

To satisfy an independent auditor, you’ll need to present concrete evidence of these controls in action. This includes formal policies that are regularly reviewed, comprehensive training records, and signed non-disclosure agreements that cover all relevant personnel. For a detailed breakdown of the requirements, you can refer to the complete list of ISO 27001 Annex A controls which categorizes these into the specific themes used in the 2022 standard.

Key Organisational Controls to Prioritise

Control 5.1 and 5.7 are critical for demonstrating management commitment and proactive risk management. Control 5.7, a new addition to the 2022 version, requires evidence of active threat intelligence gathering. You must show how your organization identifies and reacts to emerging threats in real-time. For SaaS-heavy firms, Control 5.23 is indispensable. It dictates how you manage information security when using cloud services, requiring rigorous vendor assessments and clear service level agreements. Beyond security, to gain better visibility into your software assets and governance, you can visit LicenseIQ to discover and recover wasted spend on Microsoft 365 licenses.

Furthermore, Control 5.30 focuses on ICT readiness for business continuity. It’s no longer enough to have a simple backup; you must prove your systems can recover within defined timeframes. This is a point where security overlaps with operational resilience. Aligning this with a broader ISO 22301 strategy ensures your business remains functional even during a major disruption.

Essential People Controls for 2026

Control 6.3 mandates comprehensive information security awareness, education, and training. Auditors look for more than just a signed attendance sheet; they seek evidence that staff understand their specific roles in protecting data. Control 6.7 has become vital for the modern distributed workforce. It requires specific security measures for remote working, ensuring that the same level of protection applies outside the traditional office perimeter.

Finally, Control 6.8 addresses information security event reporting. You must demonstrate that your staff are trained to recognize and report incidents immediately. Testing your staff’s response capability through simulated exercises provides the high-level evidence that certification bodies require. If you’re looking to deepen your team’s expertise, our accredited training programs offer the technical depth needed to manage these human-centric risks effectively. This methodical approach ensures your ISMS is not just compliant, but practically effective in a global business environment.

Physical and Technological Controls Checklist

Physical and technological controls represent the operational execution of your security strategy. While organizational policies provide the necessary framework, these controls are the tangible barriers protecting your information assets. Every implementation must be strictly proportional to the risks identified in your initial assessment, a requirement central to the ISO/IEC 27001:2022 standard. To satisfy an auditor’s request for verification, you’ll need to present technical logs, configuration screenshots, and detailed site inspection records. This practical evidence demonstrates that your iso 27001 controls checklist is functioning in a live environment rather than existing as a purely theoretical exercise.

Physical Security Requirements

Physical security monitoring, addressed in Control 7.4, requires continuous oversight of sensitive areas. Auditors typically look for active CCTV systems or intrusion detection alarms that generate reviewable logs. Control 7.10 focuses on the full lifecycle of storage media. You must demonstrate secure acquisition, authorized use, and the eventual decommissioning of all hardware. Similarly, Control 7.14 dictates the secure disposal or re-use of equipment. You’ll need to show that data is irrecoverably wiped before hardware leaves your control. This prevents data leakage through legacy devices and ensures that your physical perimeter remains secure.

High-Impact Technological Controls

Technological controls are often the most complex to verify during a certification audit because they require deep technical evidence. Control 8.9 requires strict configuration management to ensure all systems are hardened against known vulnerabilities. This process involves maintaining standard builds, managing administrative privileges, and disabling unnecessary services. For data protection, Control 8.24 mandates robust cryptography. You must evidence that encryption is applied both to data at rest and data in transit using industry-standard algorithms. Finally, Control 8.28 focuses on secure coding. If your organization develops software, you must integrate security into every stage of the software development lifecycle. For teams managing these development pipelines, Test Triangle provides the Atlassian support needed to ensure that security is a foundational element of the build process rather than an afterthought. By documenting these technical configurations, you provide the objective proof required for successful certification.

Implementation Strategy: From Gap Analysis to SoA

Transitioning from a conceptual framework to a certified Information Security Management System (ISMS) requires a disciplined, four-step execution strategy. This process ensures that your iso 27001 controls checklist is not merely a list of aspirations but a verified set of operational safeguards. The sequence begins with a thorough gap analysis against the 93 controls to identify existing vulnerabilities. This stage provides the baseline data necessary to determine where your current security posture deviates from the requirements of the 2022 standard. It’s a technical deep dive that requires objective evidence of current practices versus the standard’s expectations.

Once gaps are identified, you must perform a formal risk assessment to determine which controls are applicable to your specific organizational scope. This leads directly to drafting the Statement of Applicability (SoA). Every exclusion in this document must be supported by a valid business or technical justification. You cannot simply opt out of a control because it’s difficult to implement. Finally, you will generate a Risk Treatment Plan (RTP). This plan outlines the specific timeline, resources, and ownership required for control implementation, serving as your roadmap toward the final audit. It acts as a bridge between your current state and the level of maturity required for international certification. Organizations managing multiple management system transitions simultaneously may also benefit from reviewing a structured ISO 45001 audit checklist to understand how parallel compliance frameworks handle gap analysis and transition audits. Similarly, suppliers operating in specialized industries such as rail can find value in consulting an IRIS certification audit checklist to see how sector-specific standards structure their own gap analysis and evidence requirements.

Common Pitfalls in the SoA

The SoA is often the first document reviewed by an external auditor, and errors here can signal systemic weaknesses. One frequent mistake is excluding controls without a documented justification. If a control is deemed non-applicable, the reasoning must be explicit and logical. Additionally, many firms fail to update their SoA when their technology stack or organizational scope changes. You must ensure your documentation references the 2022 version of Annex A. Using outdated 2013 controls is a critical non-conformity that will stall your certification progress and necessitate a full re-audit.

Preparing for Internal Audits

The internal audit serves as a vital dress rehearsal for the formal certification assessment. It allows your organization to identify and remediate non-conformities (NCs) before they are flagged by an external body. To ensure this process is rigorous, many organizations utilize accredited internal auditor training to equip their teams with the necessary technical scrutiny. Viewing NCs as opportunities for improvement rather than failures ensures a smoother path to final approval. To begin your journey toward a globally recognized certification, you can request a formal assessment from International Associates today. This methodical approach ensures your ISMS is robust, ethical, and ready for the global stage.

The Certification Audit with International Associates

International Associates facilitates a methodical, high-standard assessment process to verify that your ISMS meets the rigorous requirements of the 2022 standard. Our approach is divided into two distinct phases to ensure thoroughness and institutional weight. Stage 1 focuses on a comprehensive documentation review where auditors examine your iso 27001 controls checklist and Statement of Applicability to ensure the system’s design is fundamentally sound. This phase identifies any structural gaps before you proceed to the more intensive second stage. It’s a critical checkpoint that prevents costly failures during the final verification.

Stage 2 involves the practical verification of control implementation. Our auditors conduct on-site or remote inspections to observe how your safeguards function in real-world scenarios. This global network of professionals ensures we maintain a deep understanding of local regulatory compliance while adhering to international auditing protocols. This duality allows us to act as a sophisticated bridge for businesses operating across multiple jurisdictions, providing the stability and confidence needed to navigate complex global regulations without unnecessary friction.

What Auditors Look for in 2026

In the current regulatory environment, auditors prioritize evidence that the ISMS is a functional part of your business operations rather than a ‘paper exercise’. You’ll need to demonstrate proof of continuous improvement by showing how your organization manages security incidents and addresses findings from internal audits. Additionally, management must display a technical and strategic understanding of the specific risks relevant to their industrial sector. This level of engagement proves that security is a core business priority rather than an administrative afterthought created just before the audit.

Why Choose an Independent Certification Body?

Selecting an independent certification body allows your organization to avoid the extensive bureaucracy often associated with ‘Big 4’ firms while still achieving a globally recognized credential. Many businesses find that they can achieve higher value and more personalized service by evaluating the cost of certification with smaller bodies vs BSI. Our firm prioritizes efficiency and technical precision, utilizing an advanced IT infrastructure to facilitate a quick turnaround for certificates. This steady, professional process ensures your business can demonstrate its commitment to information security and enhance stakeholder trust without the delays typical of larger, less agile entities.

Achieving Audit Readiness and Global Trust

The transition to the 2022 framework represents a strategic move toward a more integrated, risk-based approach to information security. By utilizing a comprehensive iso 27001 controls checklist, your organization can effectively bridge the gap between complex regulatory requirements and operational resilience. Successful certification depends on more than just technical documentation; it requires a demonstrated commitment to continuous improvement and the active management of the 93 Annex A controls within your daily business processes.

International Associates acts as a meticulous guardian of these standards. From our Glasgow-based head office and through our expansive network of global regional offices, we provide the independent verification necessary to achieve a globally recognized certification. We also offer accredited Lead Auditor training to ensure your internal teams possess high-level technical expertise. This methodical approach minimizes friction and allows your business to pursue international growth with institutional reliability and confidence.

To begin your assessment process, you can request a formal ISO 27001 certification quote from International Associates. Securing your data is a foundational pillar of modern corporate integrity, and we’re ready to support your professional journey toward standard excellence.

Frequently Asked Questions

What is the difference between ISO 27001:2013 and ISO 27001:2022 controls?

The primary difference lies in the structural consolidation and the introduction of modern security requirements. The 2013 version contained 114 controls across 14 categories, while the 2022 update features 93 controls organized into four themes: Organizational, People, Physical, and Technological. This revision introduced 11 new controls, including threat intelligence and data masking, to address contemporary digital risks like cloud computing and evolving cyber threats.

Do I need to implement all 93 controls in Annex A?

You only implement the controls that are relevant to your identified risks. While the iso 27001 controls checklist includes all 93 options, your risk assessment determines which are applicable to your specific scope. If a control doesn’t mitigate a risk within your environment, you may exclude it. Every exclusion must be formally justified within your Statement of Applicability to satisfy the auditor’s requirements.

What is a Statement of Applicability (SoA) in ISO 27001?

The SoA is a mandatory document that lists which Annex A controls you’ve selected and which you’ve excluded. It serves as a central reference for auditors to understand the design of your Information Security Management System. For every control, the SoA must explain the reason for its inclusion or exclusion, linking back to your risk treatment plan and providing a clear audit trail for independent verification.

How long does it take to implement the ISO 27001 controls checklist?

Implementation typically takes between six to twelve months, depending on your organization’s size and current security maturity. Smaller firms with existing digital safeguards may complete the process faster, while larger enterprises often require more time for documentation and staff training. The timeline is primarily driven by the need to generate sufficient evidence of the controls operating effectively for several months before the formal audit begins.

Can I exclude technological controls if I use a cloud provider?

You can’t automatically exclude technological controls simply by using a cloud provider. While the provider manages the underlying infrastructure, you remain responsible for how you configure and use those services. Controls regarding access management, encryption, and secure coding still apply to your data and applications. You must demonstrate how you verify the provider’s security through service level agreements and independent audit reports like SOC 2.

What happens if an auditor finds a non-conformity in my controls?

A non-conformity indicates that a requirement of the standard hasn’t been met. Minor non-conformities usually don’t prevent certification, provided you submit an acceptable corrective action plan to the auditor. Major non-conformities represent a systemic failure and must be resolved before a certificate is issued. Auditors view these findings as opportunities for improvement, ensuring your management system remains robust and effective in a global context.

How often should I review my ISO 27001 controls?

Controls should be reviewed at least annually or whenever significant changes occur in your technology stack or business environment. Regular internal audits and management reviews ensure the iso 27001 controls checklist remains aligned with your evolving risk profile. Continuous monitoring allows you to detect vulnerabilities early and maintain the integrity of your certification between the formal surveillance audits conducted by your certification body.

Is ISO 27001 certification mandatory for SaaS companies in 2026?

While not legally mandatory in most jurisdictions, ISO 27001 has become a de facto requirement for SaaS providers during enterprise procurement. Most large-scale clients now mandate certification as a prerequisite for vendor selection to ensure supply chain security. Holding a valid 2022 certificate demonstrates your commitment to international standards and provides the necessary assurance for stakeholders concerned about data breaches and regulatory adherence.