ISO 27001 Annex A.5 Organizational Controls Explained (37 controls)

What A.5 Typically Covers

• Policies for information security (A.5.1) and related governance artefacts
• Roles, segregation of duties, contact with authorities and special interest groups
• A.5.7 Threat intelligence — see dedicated explainer
• Project, inventory, acceptable use, access rights themes
• Supplier relationships and ICT service delivery
• Incident management, business continuity readiness themes, compliance reviews

Use your Statement of Applicability to record applicability and implementation status for each A.5 control.

Frequently Asked Questions

How many A.5 controls are there?

37 organizational controls: A.5.1 through A.5.37.

Is A.5.7 new in 2022?

A.5.7 Threat intelligence is one of the controls introduced in the 2022 control set (part of the 11 new controls called out in transition guidance).

Do organizational controls replace policies?

No. Clause 5.2 still requires the information security policy. A.5 includes Policies for information security (A.5.1) and related organizational topics.

Related ISO 27001 Resources

ISO 27001 hub · 93 controls · SoA · CSA · A.5.7