ISO 27001 Requirements: Clauses 4 to 10, the 93 Annex A Controls, and a Checklist
Every ISO 27001 requirement in one place: what the clauses ask for, which documents you must keep, the full Annex A control list, and what a certification auditor checks for each.
Most guides to ISO 27001 requirements stop at a list of clause titles. That is not much help when an auditor asks to see the evidence behind them. We audit information security management systems for a living, so this guide is written from the other side of the table: what each requirement means, what you must document, and what we look for when we test it.
Quick answer: ISO 27001 requirements are set out in clauses 4 to 10 of ISO/IEC 27001:2022. They cover context and scope, leadership, planning and risk, support, operation, performance evaluation, and improvement. You must meet all of them to be certified. Annex A then lists 93 controls in four themes. You do not have to apply every control, but you must consider each one in your Statement of Applicability and justify any you exclude.
How the ISO 27001 Requirements Are Structured
ISO/IEC 27001:2022 has two parts. Clauses 0 to 3 introduce the standard and contain no requirements. Clauses 4 to 10 are the mandatory requirements for your information security management system (ISMS). Annex A is the reference list of controls you choose from based on your risks.
Clauses 4–10
Mandatory. Every requirement applies to every certified organization.
Annex A
93 controls in four themes. You select those your risks need.
Statement of Applicability
Links the two: each control, whether it applies, and why.
Amendment 1:2024
Added climate change to clauses 4.1 and 4.2.
The 2013 edition can no longer be certified to. The transition to ISO/IEC 27001:2022 ended on 31 October 2025, so every audit now uses the 2022 edition.
ISO 27001 Requirements in Clauses 4 to 10, Explained
These are the ISO 27001 requirements clause by clause, with what an auditor typically asks to see.
| Clause | What it requires | What the auditor checks |
|---|---|---|
| 4.1 Context | Identify internal and external issues that affect your ISMS, including whether climate change is relevant | A recorded analysis of issues, reviewed when things change |
| 4.2 Interested parties | Identify who has an interest in your security and what they require | Customer, legal and contractual requirements, and which ones the ISMS addresses |
| 4.3 Scope | Define the boundaries of the ISMS | A documented scope that matches what you sell and where you operate |
| 5.1–5.3 Leadership | Top management commits to the ISMS, sets the policy and assigns roles | A signed policy, named responsibilities, and leaders who can explain them |
| 6.1 Risks and opportunities | Define and run a risk assessment and risk treatment process | Risk criteria, risk owners, a risk register, a treatment plan and the Statement of Applicability |
| 6.2 Objectives | Set measurable security objectives and plan how to meet them | Objectives with owners, targets and progress |
| 6.3 Planning of changes | Plan changes to the ISMS in a controlled way (new in 2022) | Evidence that ISMS changes were planned, not ad hoc |
| 7.1–7.5 Support | Provide resources, competent people, awareness, communication and controlled documents | Training and competence records, awareness evidence, document control |
| 8.1–8.3 Operation | Run the processes you planned, perform risk assessments at planned intervals and carry out risk treatment | Recent risk assessment results and treatment actions completed |
| 9.1 Monitoring and measurement | Decide what to measure, how and when, and evaluate the results | Metrics you actually review, not just collect |
| 9.2 Internal audit | Audit the whole ISMS at planned intervals with objective, competent auditors | An audit programme, reports and follow-up of findings |
| 9.3 Management review | Top management reviews ISMS performance at planned intervals | Review records covering the required inputs, with decisions and actions |
| 10.1–10.2 Improvement | Improve continually, and correct nonconformities at their root cause | Nonconformity log, root cause analysis and checks that fixes worked |
Two clauses decide most audits. Clause 6.1 on risk drives which controls you need, and clause 9 proves the ISMS is actually running. If your risk assessment is generic or your internal audit and management review have not happened yet, Stage 2 cannot go ahead.
ISO 27001 Mandatory Documents and Records
ISO 27001 calls these "documented information". The standard requires the following. Your Annex A controls and your own processes may add more.
| Document or record | Clause |
|---|---|
| ISMS scope | 4.3 |
| Information security policy | 5.2 |
| Risk assessment process | 6.1.2 |
| Risk treatment process | 6.1.3 |
| Statement of Applicability | 6.1.3 d) |
| Information security objectives | 6.2 |
| Evidence of competence | 7.2 |
| Documents needed to run processes as planned | 7.5.1 b), 8.1 |
| Risk assessment results | 8.2 |
| Risk treatment results | 8.3 |
| Monitoring and measurement results | 9.1 |
| Internal audit programme and results | 9.2.2 |
| Management review results | 9.3.3 |
| Nonconformities, actions taken and results | 10.2 |
Documents do not need to be long. A clear one-page scope that matches reality is better than a long one that does not.
Want to see how these requirements are tested in a certification audit? See our ISO 27001 audit process, from scope review to certificate.
See ISO 27001 certificationISO 27001 Annex A Controls: The Full List of 93
The 2022 edition reorganized Annex A into 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological. Eleven controls are new compared with the 2013 edition, marked below.
Organizational controls (A.5): 37 controls
| Control | Name |
|---|---|
| A.5.1 | Policies for information security |
| A.5.2 | Information security roles and responsibilities |
| A.5.3 | Segregation of duties |
| A.5.4 | Management responsibilities |
| A.5.5 | Contact with authorities |
| A.5.6 | Contact with special interest groups |
| A.5.7 | Threat intelligence (new in 2022) |
| A.5.8 | Information security in project management |
| A.5.9 | Inventory of information and other associated assets |
| A.5.10 | Acceptable use of information and other associated assets |
| A.5.11 | Return of assets |
| A.5.12 | Classification of information |
| A.5.13 | Labelling of information |
| A.5.14 | Information transfer |
| A.5.15 | Access control |
| A.5.16 | Identity management |
| A.5.17 | Authentication information |
| A.5.18 | Access rights |
| A.5.19 | Information security in supplier relationships |
| A.5.20 | Addressing information security within supplier agreements |
| A.5.21 | Managing information security in the ICT supply chain |
| A.5.22 | Monitoring, review and change management of supplier services |
| A.5.23 | Information security for use of cloud services (new in 2022) |
| A.5.24 | Information security incident management planning and preparation |
| A.5.25 | Assessment and decision on information security events |
| A.5.26 | Response to information security incidents |
| A.5.27 | Learning from information security incidents |
| A.5.28 | Collection of evidence |
| A.5.29 | Information security during disruption |
| A.5.30 | ICT readiness for business continuity (new in 2022) |
| A.5.31 | Legal, statutory, regulatory and contractual requirements |
| A.5.32 | Intellectual property rights |
| A.5.33 | Protection of records |
| A.5.34 | Privacy and protection of PII |
| A.5.35 | Independent review of information security |
| A.5.36 | Compliance with policies, rules and standards for information security |
| A.5.37 | Documented operating procedures |
People controls (A.6): 8 controls
| Control | Name |
|---|---|
| A.6.1 | Screening |
| A.6.2 | Terms and conditions of employment |
| A.6.3 | Information security awareness, education and training |
| A.6.4 | Disciplinary process |
| A.6.5 | Responsibilities after termination or change of employment |
| A.6.6 | Confidentiality or non-disclosure agreements |
| A.6.7 | Remote working |
| A.6.8 | Information security event reporting |
Physical controls (A.7): 14 controls
| Control | Name |
|---|---|
| A.7.1 | Physical security perimeters |
| A.7.2 | Physical entry |
| A.7.3 | Securing offices, rooms and facilities |
| A.7.4 | Physical security monitoring (new in 2022) |
| A.7.5 | Protecting against physical and environmental threats |
| A.7.6 | Working in secure areas |
| A.7.7 | Clear desk and clear screen |
| A.7.8 | Equipment siting and protection |
| A.7.9 | Security of assets off-premises |
| A.7.10 | Storage media |
| A.7.11 | Supporting utilities |
| A.7.12 | Cabling security |
| A.7.13 | Equipment maintenance |
| A.7.14 | Secure disposal or re-use of equipment |
Technological controls (A.8): 34 controls
| Control | Name |
|---|---|
| A.8.1 | User endpoint devices |
| A.8.2 | Privileged access rights |
| A.8.3 | Information access restriction |
| A.8.4 | Access to source code |
| A.8.5 | Secure authentication |
| A.8.6 | Capacity management |
| A.8.7 | Protection against malware |
| A.8.8 | Management of technical vulnerabilities |
| A.8.9 | Configuration management (new in 2022) |
| A.8.10 | Information deletion (new in 2022) |
| A.8.11 | Data masking (new in 2022) |
| A.8.12 | Data leakage prevention (new in 2022) |
| A.8.13 | Information backup |
| A.8.14 | Redundancy of information processing facilities |
| A.8.15 | Logging |
| A.8.16 | Monitoring activities (new in 2022) |
| A.8.17 | Clock synchronization |
| A.8.18 | Use of privileged utility programs |
| A.8.19 | Installation of software on operational systems |
| A.8.20 | Networks security |
| A.8.21 | Security of network services |
| A.8.22 | Segregation of networks |
| A.8.23 | Web filtering (new in 2022) |
| A.8.24 | Use of cryptography |
| A.8.25 | Secure development life cycle |
| A.8.26 | Application security requirements |
| A.8.27 | Secure system architecture and engineering principles |
| A.8.28 | Secure coding (new in 2022) |
| A.8.29 | Security testing in development and acceptance |
| A.8.30 | Outsourced development |
| A.8.31 | Separation of development, test and production environments |
| A.8.32 | Change management |
| A.8.33 | Test information |
| A.8.34 | Protection of information systems during audit testing |
Not every control has to apply. A fully remote company with no office may exclude some physical controls, for example, if its Statement of Applicability explains why. What an auditor will not accept is an exclusion with no reason, or a control marked as applied with no evidence behind it.
The Statement of Applicability: Where Most Audits Focus
The Statement of Applicability (SoA) lists all 93 controls. For each one it says whether it applies, why, and whether it is implemented. It is the document auditors use to plan which controls to sample at Stage 2.
- Link each control to a risk or a requirement, such as a customer contract or a law.
- Justify every exclusion in a sentence an outsider can follow.
- Keep it current. An SoA that lists controls you dropped a year ago is a common nonconformity.
How Auditors Check ISO 27001 Requirements
A certification audit runs in two stages. At Stage 1 we review your documents, scope, risk assessment and SoA, and confirm you are ready. At Stage 2 we test that controls work in practice by sampling real records: access reviews, joiner and leaver records, change tickets, backup restores, vulnerability fixes and incident logs.
Findings are graded. A major nonconformity means a requirement is not met or a control is not working, and it must be closed before a certificate can be issued. A minor nonconformity is an isolated lapse that needs a corrective action plan. The certificate is valid for three years, with surveillance audits in years two and three. Our guide on how to get ISO 27001 certified walks through the full process, and many audits can now run online, as explained in our guide to remote ISO audits.
ISO 27001 Requirements Checklist
Use this ISO 27001 requirements checklist to confirm you are ready for Stage 1.
- Context, interested parties and their requirements are recorded, including climate change relevance
- The ISMS scope is documented and matches what customers expect
- The information security policy is approved and communicated
- Roles and responsibilities are assigned and understood
- The risk assessment method, risk criteria and risk owners are defined
- The risk assessment is complete and the treatment plan approved
- The Statement of Applicability covers all 93 controls with justifications
- Security objectives are measurable and tracked
- Competence and awareness records exist for people in scope
- Controls have run long enough to produce evidence
- An internal audit of the whole ISMS is complete
- A management review has taken place and is recorded
- Nonconformities are logged with root cause and corrective action
Need people who can run your internal audit? Our ISO internal auditor training covers the skills clause 9.2 calls for.
Working out your budget?
See how audit days, scope and sites set the price of ISO 27001 certification.
ISO 27001 Certification with Accredify Global
Accredited
ISO/IEC 27001 is in our UAF accreditation scope, and our certificates can be verified.
Senior auditor
A senior auditor leads your Stage 1 and Stage 2 audits and stays your point of contact.
Fixed fee
One fixed-fee proposal for your real scope, with no hidden costs or scope creep added later.
Impartial
We audit and certify your ISMS. We do not write it for you.
Comparing certification bodies? Our guide to ISO 27001 certification companies has a scorecard, and ISO 27001 accreditation vs certification explains what to check. Software teams can read ISO 27001 for SaaS and ISO 27001 vs SOC 2, and teams handling personal data can add ISO 27701. Our trust and impartiality page sets out the rules we follow.
Not sure your ISMS meets every requirement yet?
Tell us your scope, headcount and deadline. We'll explain what Stage 1 will look at, suggest dates and send a fixed-fee proposal.
Book your free scope review →ISO 27001 Requirements FAQ
What are the ISO 27001 requirements?
They are the mandatory requirements in clauses 4 to 10 of ISO/IEC 27001:2022: context and scope, leadership, planning and risk, support, operation, performance evaluation, and improvement. Annex A adds 93 controls that you select based on your risks.
How many requirements are in ISO 27001?
There are seven requirement clauses, 4 to 10, each with several sub-clauses. All of them apply to every certified organization. The 93 Annex A controls are separate and are selected through your risk assessment.
How many controls are in ISO 27001 Annex A?
ISO/IEC 27001:2022 Annex A has 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological. Eleven of them are new compared with the 2013 edition.
Do we have to implement all 93 Annex A controls?
No. You must consider every control in your Statement of Applicability and implement the ones your risks and requirements call for. Any control you exclude needs a clear justification.
What documents are mandatory for ISO 27001?
The ISMS scope, information security policy, risk assessment and treatment processes, Statement of Applicability, security objectives, evidence of competence, risk assessment and treatment results, monitoring results, the internal audit programme and results, management review results, and nonconformity records.
What is the Statement of Applicability?
It is a required document that lists all 93 Annex A controls and records whether each applies, why, and whether it is implemented. Auditors use it to plan which controls to test.
What changed in ISO 27001:2022?
Annex A was reorganized from 114 controls in 14 groups into 93 controls in four themes, with 11 new controls. A new clause 6.3 on planning changes was added, and Amendment 1:2024 added climate change to clauses 4.1 and 4.2.
Is ISO 27001 mandatory?
No law requires it in most countries, but many customers, tenders and contracts do. Certification shows an independent body has audited your ISMS against every requirement.
What happens if we don't meet a requirement at audit?
The auditor raises a nonconformity. A major nonconformity must be closed before the certificate is issued; a minor one needs a corrective action plan.