How Many Controls in ISO 27001?

ISO 27001 is required to improve information security. The compliance measure’s controls can add professional processes into a business and create the operations required to manage daily tasks safely. 

ISO 27001 consists of 114 Annex A controls that are segmented into 14 different domains. This may sound intimidating, but we can assure you that it isn’t. Companies looking to adopt the ISO standard and operate in line with its remits should pay attention to the 14 domains, as the controls are all encompassed within those sections. 

It should also be noted that the controls are not all mandatory, so it is up to the business and the supporting IT agency, if chosen, to understand what works for the company in question to meet the ISO 27001 overall requirements and achieve certificated status.

What Are the Controls for ISO 27001?

The 14 controls that make up ISO 27001 are as follows:

• Information Security Policies (2 Controls)
  
  

The objective is to ensure each organisation has formalised written policies aligning with ISO 27001 standards and the company’s requirements. This is important because even though ISO 27001 offers the processes to follow, its success is hinged on how businesses use the structure to improve their operations. That is your answer if you have ever wanted to know how one form of compliance can suit many different sectors.

• Organisation of Information Security (7 Controls)
  
  

With an objective to establish a security role framework and to create security guidelines for employees to access when hybrid working, this element is essential in the modern working world. More than 20 million people in the UK work remotely, and this control ensures they can access information safely without information being exposed to malicious sources. 

• Human Resources Security (6 Controls)
  
  

ISO 27001 protects a business at all stages of the employee cycle, offering structures to support pre-, during, and post-employment scenarios. An official set of responsibilities must be published for this control measure, which also considers background checks, training, format procedures, and any other tools deemed necessary to protect a business.

• Asset Management (10 Controls)
  
  

Assets are a company’s top priority to protect, whether that covers employees, data or products. This control requires acceptable usage to be defined for how assets are managed and also covers the handling of media content.

• Access Control (14 Controls)
  
  

In recent years, 450% in unlawful access to business data has been experienced across global organisations, representing how important sufficient access control measures are. This element of ISO 27001 requires tools such as access control policies, authorisation of digital processes, and programme restrictions.

• Cryptography (2 Controls)
  
  

This involves ensuring that key and encryption management is in place to protect data and other forms of confidential information. 

• Physical and Environmental Security (15 Controls)
  
  

Any loss of data can severely impact business operations. This control measure prevents assets of all forms from becoming compromised through loss of all forms or damage. Whereas many measures look at digital security, this requires a physical barrier to be put into place, sufficiently protecting operations and equipment. This is an example of not all measures being needed by all businesses, as not everyone will have assets of this form to protect.

• Operational Security (14 Controls)
  
  

For this measure, all company processes must be documented, approved, and adhered to by all stakeholders to ensure complete security across all business operations.

• Communications Security (7 Controls)
  
  

This protects both incoming and outgoing communications, as data transfer is one of the top reasons for company security breaches. Even forums such as social media are included within this as it offers an example of a company that malicious sources can access.

• System Acquisition, Development, and Maintenance (13 Controls)
  
  

A large part of business operations involves transferring data for all above-outlined purposes. This element requires updating systems and data with the latest rules and authorisations to protect the wider business.

• Supplier Relationships (5 Controls)
  
  

Suppliers will need to access company materials from time to time, so this aspect ensures that can be done in a controlled way. This requires format agreements and processes to be in place with regular audit procedures also outlined.

• Information Security Incident Management (7 Controls)
  
  

Perhaps one of the most relevant tools in 2023, this encourages the professional management of any information security breaches including risk planning and recovering management.

• Information Security Aspects of Business Continuity (4 Controls)
  
  

A security operations centre should always have a process in place that aligns with continuity planning and recovery. This annex requires that any decisions made with this purpose align with the wider business planning.

• Compliance (8 Controls)
  
  

To end up, compliance is the final annex which requires a full view of security, legal, statutory, and contractual elements to be managed completely to ensure no access can be made to a company without the official permission. 

What Are the Benefits of Adhering to the ISO 27001 Controls?