The ISO/IEC 27001:2022 clauses

Annex A controls

The requirement standard has 30 clause records from 4 to 10. Each page states the requirement in plain words, the guidance lens for the draft, the evidence an assessor asks for and the question an auditor will put to you.

Filter by code or word

30 of 30 shown

4. Context of the organization

4.1Understanding the organization and its context
4.2Understanding the needs and expectations of interested parties
4.3Determining the scope of the information security management system
4.4Information security management system

5. Leadership

5.1Leadership and commitment
5.2Policy
5.3Organizational roles, responsibilities and authorities

6. Planning

6.1.1Actions to address risks and opportunities: general
6.1.2Information security risk assessment
6.1.3Information security risk treatment
6.2Information security objectives and planning to achieve them
6.3Planning of changes

7. Support

7.1Resources
7.2Competence
7.3Awareness
7.4Communication
7.5.1Documented information: general
7.5.2Documented information: creating and updating
7.5.3Documented information: control

8. Operation

8.1Operational planning and control
8.2Information security risk assessment
8.3Information security risk treatment

9. Performance evaluation

9.1Monitoring, measurement, analysis and evaluation
9.2.1Internal audit: general
9.2.2Internal audit programme
9.3.1Management review: general
9.3.2Management review inputs
9.3.3Management review results

10. Improvement

10.1Continual improvement
10.2Nonconformity and corrective action

The guidance lens is our own statement. The requirement and evidence fields are read from the held ISO/IEC 27001:2022 record. The DIS text is not public and is not quoted.