Your security and compliance glossary

All the terms you need to know when you’re trying to get compliance audit ready, fast.

Show filters
GLOSSARY
ISO 27001
Annex A Controls

What are the Annex A Controls?


Annex A of the ISO 27001 standard consists of a list of security controls organizations can utilize to improve the security of their information assets. ISO 27001 comprises 114 controls divided into 14 sections, also known as domains. The sections are focused on information technology and beyond, taking into consideration the wide range of factors that can impact the security of an organization’s information environment. The 14 ISO domains cover organizational issues, human resources, IT, physical security, and legal issues. Organizations are not required to implement the entire list of ISO 27001’s controls but instead use it as a list of possibilities to consider based on their unique needs. 


Utilizing the 114 controls listed in Annex A, a company can select those applicable to its needs and the needs of its customers. The 14 domains are:

  • Information security policies (A.5)
  • Organization of information security and assignment of responsibility (A.6)
  • Human resources security (A.7)
  • Asset management (A.8)
  • User access control (A.9)
  • Encryption and management of sensitive information (A.10)
  • Physical and environmental security (A.11)
  • Operational security (A.12)
  • Communications security (A.13)
  • System acquisition, development, and maintenance (A.14)
  • Supplier relationships (A.15)
  • Information security incident management (A.16)
  • Information security aspects of business continuity management (A.17)
  • Compliance (A.18)

The compliance news you need. Delivered securely to your inbox.

Subject to Vanta's Privacy Policy, you agree to allow Vanta to contact you via the email provided for marketing and other purposes

Everything you need to get compliance audit ready, fast.