ISO 27001:2022 Annex A Control Matrix
The complete reference to all 93 controls in ISO/IEC 27001:2022 Annex A, grouped into four themes — and a clear view of which controls a continuous AI penetration test produces audit evidence for.
ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS). Its Annex A lists the reference controls an organisation selects from to treat the risks it identifies. The 2022 revision reorganised the previous 114 controls into 93 controls across four themes, and added 11 new controls for a modern threat landscape — including threat intelligence, information security for cloud services, data leakage prevention, and secure coding.
This page reproduces the full control list for reference, and marks the Evidence controls that a technical penetration test most directly supports. A test does not satisfy the organizational, people and physical controls that make up the human and governance side of an ISMS — but for the technological controls in Annex A.8, and several access and threat-intelligence controls in A.5, a documented, reproducible test is exactly the evidence an auditor asks for.
How to read this: the matrix below is organised by theme. The Pentest evidence column flags the 29 controls for which AssurePort's continuous testing produces findings, proofs of concept and remediation evidence you can attach to your Statement of Applicability. The remaining controls are satisfied through policy, process and physical measures.
A.5 — Organizational controls
37 controlsGovernance, policy, access, supplier and incident management — the organizational backbone of an ISMS.
| Ref | Control | Pentest evidence |
|---|---|---|
| A.5.1 | Policies for information security | |
| A.5.2 | Information security roles and responsibilities | |
| A.5.3 | Segregation of duties | |
| A.5.4 | Management responsibilities | |
| A.5.5 | Contact with authorities | |
| A.5.6 | Contact with special interest groups | |
| A.5.7 | Threat intelligence | Evidence |
| A.5.8 | Information security in project management | |
| A.5.9 | Inventory of information and other associated assets | Evidence |
| A.5.10 | Acceptable use of information and other associated assets | |
| A.5.11 | Return of assets | |
| A.5.12 | Classification of information | |
| A.5.13 | Labelling of information | |
| A.5.14 | Information transfer | |
| A.5.15 | Access control | Evidence |
| A.5.16 | Identity management | Evidence |
| A.5.17 | Authentication information | Evidence |
| A.5.18 | Access rights | Evidence |
| A.5.19 | Information security in supplier relationships | |
| A.5.20 | Addressing information security within supplier agreements | |
| A.5.21 | Managing information security in the ICT supply chain | Evidence |
| A.5.22 | Monitoring, review and change management of supplier services | |
| A.5.23 | Information security for use of cloud services | Evidence |
| A.5.24 | Information security incident management planning and preparation | |
| A.5.25 | Assessment and decision on information security events | |
| A.5.26 | Response to information security incidents | |
| A.5.27 | Learning from information security incidents | |
| A.5.28 | Collection of evidence | |
| A.5.29 | Information security during disruption | |
| A.5.30 | ICT readiness for business continuity | |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | |
| A.5.32 | Intellectual property rights | |
| A.5.33 | Protection of records | |
| A.5.34 | Privacy and protection of personal identifiable information (PII) | |
| A.5.35 | Independent review of information security | Evidence |
| A.5.36 | Compliance with policies, rules and standards for information security | |
| A.5.37 | Documented operating procedures |
A.6 — People controls
8 controlsScreening, awareness, responsibilities and event reporting — the human layer of information security.
| Ref | Control | Pentest evidence |
|---|---|---|
| A.6.1 | Screening | |
| A.6.2 | Terms and conditions of employment | |
| A.6.3 | Information security awareness, education and training | |
| A.6.4 | Disciplinary process | |
| A.6.5 | Responsibilities after termination or change of employment | |
| A.6.6 | Confidentiality or non-disclosure agreements | |
| A.6.7 | Remote working | |
| A.6.8 | Information security event reporting |
A.7 — Physical controls
14 controlsPerimeters, entry, equipment and media — protecting the physical environment that hosts information.
| Ref | Control | Pentest evidence |
|---|---|---|
| A.7.1 | Physical security perimeters | |
| A.7.2 | Physical entry | |
| A.7.3 | Securing offices, rooms and facilities | |
| A.7.4 | Physical security monitoring | |
| A.7.5 | Protecting against physical and environmental threats | |
| A.7.6 | Working in secure areas | |
| A.7.7 | Clear desk and clear screen | |
| A.7.8 | Equipment siting and protection | |
| A.7.9 | Security of assets off-premises | |
| A.7.10 | Storage media | |
| A.7.11 | Supporting utilities | |
| A.7.12 | Cabling security | |
| A.7.13 | Equipment maintenance | |
| A.7.14 | Secure disposal or re-use of equipment |
A.8 — Technological controls
34 controlsAccess, cryptography, logging, network and secure development — the technical controls a penetration test most directly evidences.
| Ref | Control | Pentest evidence |
|---|---|---|
| A.8.1 | User endpoint devices | |
| A.8.2 | Privileged access rights | Evidence |
| A.8.3 | Information access restriction | Evidence |
| A.8.4 | Access to source code | Evidence |
| A.8.5 | Secure authentication | Evidence |
| A.8.6 | Capacity management | |
| A.8.7 | Protection against malware | |
| A.8.8 | Management of technical vulnerabilities | Evidence |
| A.8.9 | Configuration management | Evidence |
| A.8.10 | Information deletion | |
| A.8.11 | Data masking | |
| A.8.12 | Data leakage prevention | Evidence |
| A.8.13 | Information backup | |
| A.8.14 | Redundancy of information processing facilities | |
| A.8.15 | Logging | Evidence |
| A.8.16 | Monitoring activities | Evidence |
| A.8.17 | Clock synchronization | |
| A.8.18 | Use of privileged utility programs | Evidence |
| A.8.19 | Installation of software on operational systems | |
| A.8.20 | Networks security | Evidence |
| A.8.21 | Security of network services | Evidence |
| A.8.22 | Segregation of networks | Evidence |
| A.8.23 | Web filtering | |
| A.8.24 | Use of cryptography | Evidence |
| A.8.25 | Secure development life cycle | Evidence |
| A.8.26 | Application security requirements | Evidence |
| A.8.27 | Secure system architecture and engineering principles | Evidence |
| A.8.28 | Secure coding | Evidence |
| A.8.29 | Security testing in development and acceptance | Evidence |
| A.8.30 | Outsourced development | |
| A.8.31 | Separation of development, test and production environments | Evidence |
| A.8.32 | Change management | |
| A.8.33 | Test information | |
| A.8.34 | Protection of information systems during audit testing |
From findings to audit evidence
Passing an ISO 27001 audit is not about owning a scanner; it is about producing evidence that your controls are effective and that you act on what you find. AssurePort is built around that gap. Every scan maps its findings to the controls they touch — not only ISO 27001, but also GDPR, NIS2, DORA and PCI-DSS — and every finding ships with a human-verifiable proof of concept and a concrete remediation. When an auditor asks how you satisfy A.8.8 management of technical vulnerabilities or A.8.29 security testing, you hand them a dated, reproducible record instead of a promise.
The same platform runs the authenticated compliance dashboard inside the console, where you self-assess each Annex A control and track your Statement of Applicability alongside live findings. Across 11 scan engines — web, API, cloud, network, Active Directory, SAP and more — AssurePort runs authorized, continuous penetration testing from $399 per scan, a fraction of the $5,000–$30,000 a one-off consultancy engagement costs — see how the approaches stack up in our comparison of AI pentesting vs PTaaS vs code scanners. For the full methodology, see our pillar guide to penetration testing, and our walkthrough of preparing for an ISO 27001:2022 audit.
Turn your controls into evidence.
Run authorized, continuous AI penetration testing mapped to ISO 27001, GDPR, NIS2, DORA and PCI-DSS — with a human-verifiable proof of concept and remediation behind every finding, from $399 per scan.
Run your first scan →Reference only. Control references and titles follow ISO/IEC 27001:2022 Annex A. This page is an educational summary and is not affiliated with, endorsed by, or a substitute for the official standard published by ISO/IEC, nor for certification by an accredited body. AssurePort is not an accredited ISO certification body; it provides the technical testing evidence that supports selected Annex A controls.