Why A.5 Is the Control Set Every ISMS Auditor Needs to Understand
If you are auditing an Information Security Management System, Annex A of ISO 27001 is where the practical security work lives. The standard itself tells you what to manage. Annex A tells you how the organisation has chosen to manage it. And within Annex A, the organisational controls in A.5 are the largest and arguably the most important group.
On this page
A.5 contains 37 controls. That is more than any other category in Annex A. They cover everything from how the organisation defines its information security policies, to how it manages threat intelligence, to what happens when someone leaves the organisation. These are not technical firewall settings or physical lock configurations. They are the governance, process, and policy controls that sit above the technical layer and make the whole system coherent.
For ISMS auditors, understanding these controls is not optional. The Statement of Applicability will tell you which A.5 controls the organisation has selected, excluded, or modified. Your job is to determine whether the selected controls are actually implemented and whether the excluded ones have a credible justification. This article walks through all 37 controls in A.5 so you know what each one requires and what to look for when you audit it.
How Annex A Is Structured and Where A.5 Fits
ISO 27001:2022 reorganised Annex A significantly from the 2013 version. The old 14 domain structure was replaced with four categories:
- A.5 Organisational controls (37 controls)
- A.6 People controls (8 controls)
- A.7 Physical controls (14 controls)
- A.8 Technological controls (34 controls)
A.5 is the governance layer. It establishes the rules, roles, processes, and relationships that everything else depends on. Without solid A.5 controls, your technical controls in A.8 will have gaps, your people controls in A.6 will lack direction, and your physical controls in A.7 will be disconnected from the rest of the system.
Each control in Annex A now comes with an attribute table that assigns it properties such as control type (preventive, detective, corrective), information security properties (confidentiality, integrity, availability), and cybersecurity concepts. These attributes help organisations during risk treatment planning and help auditors understand the intent of each control. When you are sampling Annex A controls, these attributes are useful for grouping related controls and making your sampling more efficient.
Exemplar Global Certified Training ProviderRTP No. 310970
A.5.1 to A.5.10: Policies, Roles, and Responsibilities
A.5.1 Policies for Information Security
This control requires the organisation to define, approve, publish, and communicate an information security policy, along with topic-specific policies where needed. When auditing this control, you are looking for a policy that is current, approved at an appropriate level, and actually known to staff. A policy locked in a folder that no one has read does not satisfy this control. Ask to see the approval record, the communication method, and evidence that the policy has been reviewed after significant changes.
A.5.2 Information Security Roles and Responsibilities
Roles and responsibilities for information security need to be defined and allocated. This goes beyond having a job title of “Information Security Manager.” You want to see that specific responsibilities are documented, that people in those roles understand what is expected of them, and that there are no obvious gaps where no one owns a critical function.
A.5.3 Segregation of Duties
Conflicting duties and areas of responsibility must be separated. This is a classic fraud and error prevention control. In a small organisation, full segregation is often impossible, so you are looking for compensating controls instead. An auditor who finds a single person who can initiate, approve, and process a financial transaction without any secondary check has found a real gap.
A.5.4 Management Responsibilities
Management must require all personnel to apply information security in accordance with the established policies. This control is about accountability flowing downward. Look for evidence that managers actively reinforce security expectations, not just that a policy exists somewhere.
A.5.5 Contact with Authorities
The organisation must maintain appropriate contacts with relevant authorities. This means knowing who to call when a serious incident occurs. Regulators, law enforcement, and sector-specific bodies all apply depending on the industry. Ask the information security team to describe the process for contacting authorities during an incident. Blank faces are a concern.
A.5.6 Contact with Special Interest Groups
Similar to A.5.5 but focused on industry groups, security forums, and professional networks. The intent is to keep the organisation connected to current threat intelligence and best practice. Membership of an industry CERT or a sector-specific security group satisfies this.
A.5.7 Threat Intelligence
This is a control that was added in the 2022 revision. The organisation must collect and analyse information about threats to produce threat intelligence. This is not about having a subscription to a news feed. It is about a process for gathering, evaluating, and acting on threat information. Ask how threat intelligence is collected, who reviews it, and how it feeds into risk assessment updates.
A.5.8 Information Security in Project Management
Information security requirements must be integrated into project management. This means that when a new system is being implemented, a new product launched, or a major change made, security is considered from the start rather than bolted on at the end. Check project governance documentation for security gates or review steps.
A.5.9 Inventory of Information and Other Associated Assets
An inventory of information assets and associated assets must be developed and maintained. This is foundational. Without knowing what assets exist, you cannot protect them. Look for an asset register that is current, has assigned owners, and covers information in all its forms including physical records, cloud-hosted data, and removable media.
A.5.10 Acceptable Use of Information and Other Associated Assets
Rules for acceptable use of assets must be identified, documented, and implemented. This typically takes the form of an acceptable use policy covering things like personal use of company devices, handling of sensitive information, and restrictions on installing unauthorised software. Verify that staff have acknowledged the policy.
A.5.11 to A.5.20: Supplier and Third-Party Controls
A.5.11 Return of Assets
Personnel and external parties must return all assets upon termination or change of employment. This control sits at the intersection of HR and information security. Check the offboarding process for evidence that asset return is tracked and confirmed.
A.5.12 Classification of Information
Information must be classified according to the organisation's needs, legal requirements, and value. Look for a classification scheme that is practical and actually used. A four-tier scheme that nobody applies is worse than a simple two-tier scheme that is consistently followed.
A.5.13 Labelling of Information
An appropriate set of procedures for information labelling must be developed and implemented. This links directly to A.5.12. If information is classified, it needs to be labelled so that people handling it know how to treat it. Check whether documents, emails, and data stores carry appropriate labels.
A.5.14 Information Transfer
Rules, procedures, or agreements for information transfer must be in place for all types of transfer facilities. This covers email, physical media, messaging platforms, file sharing services, and verbal communication. Ask about controls on sending sensitive information externally and whether encryption is required.
A.5.15 Access Control
Rules to control physical and logical access to information and assets must be established and implemented. This is one of the most commonly audited controls. You are looking for a documented access control policy, evidence that access is granted based on business need, and a process for reviewing and revoking access when roles change.
A.5.16 Identity Management
The full lifecycle of identities must be managed. This includes creation, maintenance, and deletion of user accounts. Ask about the process for provisioning new accounts and, critically, for deprovisioning accounts when people leave. Orphaned accounts are a persistent finding in ISMS audits.
A.5.17 Authentication Information
Allocation and management of authentication information must be controlled by a management process. This covers passwords, tokens, certificates, and other authentication credentials. Look for a password policy, evidence of enforcement through technical controls, and processes for managing shared or privileged credentials.
A.5.18 Access Rights
Access rights must be provisioned, reviewed, modified, and removed. This is distinct from A.5.15 in that it focuses on the ongoing management of rights rather than the policy framework. Regular access reviews are the key evidence to look for here.
A.5.19 Information Security in Supplier Relationships
Processes and procedures must be defined and implemented to manage information security risks associated with the use of supplier products and services. This is the starting point for supplier security. Look for a supplier security policy and evidence that it is applied when engaging new suppliers.
A.5.20 Addressing Information Security Within Supplier Agreements
Relevant information security requirements must be established and agreed with each supplier. This means contracts and agreements with suppliers who handle sensitive information must contain specific security clauses. Spot-check a few supplier contracts and look for data protection, incident notification, and audit rights clauses.
A.5.21 to A.5.30: Supply Chain, Incidents, and Business Continuity
A.5.21 Managing Information Security in the ICT Supply Chain
Processes and procedures must be defined to manage information security risks associated with the ICT products and services supply chain. This goes deeper than A.5.19 and A.5.20 by focusing on the integrity of ICT products and the risks introduced through the supply chain itself, including subcontractors and component suppliers.
A.5.22 Monitoring, Review and Change Management of Supplier Services
The organisation must regularly monitor, review, evaluate, and manage changes to supplier information security practices and service delivery. Ask for evidence of supplier performance reviews that include security considerations, not just service level metrics.
A.5.23 Information Security for Use of Cloud Services
Another control added in the 2022 revision. Processes for acquisition, use, management, and exit from cloud services must be established. Cloud is now mainstream and this control recognises that. Ask about the process for approving new cloud services, the security assessment performed before adoption, and what happens when a cloud provider is exited.
A.5.24 Information Security Incident Management Planning and Preparation
The organisation must plan and prepare for managing information security incidents by defining processes, roles, and responsibilities. This is about having an incident response plan before an incident occurs. Check that the plan exists, is current, and has been tested.
A.5.25 Assessment and Decision on Information Security Events
The organisation must assess information security events and decide whether they are to be classified as incidents. Not every event is an incident. The organisation needs a triage process. Ask how events are reported, who assesses them, and what the criteria are for escalating to incident status.
A.5.26 Response to Information Security Incidents
Incidents must be responded to in accordance with documented procedures. Look for evidence that the incident response procedure was actually followed in past incidents. Incident logs, post-incident reviews, and communication records are useful evidence sources here.
A.5.27 Learning from Information Security Incidents
Knowledge gained from analysing and resolving incidents must be used to reduce the likelihood or impact of future incidents. This is the continual improvement angle for incident management. Ask whether post-incident reviews are conducted and whether their findings feed back into risk assessment or control updates.
A.5.28 Collection of Evidence
The organisation must establish and implement procedures for the identification, collection, acquisition, and preservation of evidence related to information security events. This matters when incidents may lead to legal or disciplinary action. Evidence collected improperly may be inadmissible. Ask whether forensic procedures exist and whether staff responsible for evidence collection have been trained.
A.5.29 Information Security During Disruption
The organisation must plan how to maintain information security at an appropriate level during disruption. Business continuity planning must consider information security, not just operational recovery. Ask whether the business continuity plan addresses access controls, data availability, and communication security during an outage.
A.5.30 ICT Readiness for Business Continuity
ICT readiness must be planned, implemented, maintained, and tested based on business continuity objectives and ICT continuity requirements. This control focuses specifically on the technology layer of business continuity. Look for recovery time objectives, recovery point objectives, and evidence that ICT continuity has been tested against those targets.
Exemplar Global Certified Training ProviderRTP No. 310970A.5.31 to A.5.37: Legal, Compliance, and Privacy
A.5.31 Legal, Statutory, Regulatory and Contractual Requirements
The organisation must identify, document, and keep up to date its legal, statutory, regulatory, and contractual requirements relevant to information security. This is the information security equivalent of a compliance obligations register. It should be current and linked to actual controls that address each requirement. For Australian organisations, this will typically include the Privacy Act, the Notifiable Data Breaches scheme, and any sector-specific regulations.
A.5.32 Intellectual Property Rights
Appropriate procedures must be implemented to protect intellectual property rights. This covers software licensing, copyright, and the use of third-party content. Ask about the process for tracking software licences and managing the use of open-source components.
A.5.33 Protection of Records
Records must be protected from loss, destruction, falsification, unauthorised access, and unauthorised release. This is about records management from an information security perspective. Look for retention policies, secure disposal procedures, and controls on who can modify or delete records.
A.5.34 Privacy and Protection of Personal Identifiable Information
Privacy and protection of personal identifiable information must be ensured as required by applicable legislation and regulations. For Australian organisations this connects directly to the Australian Privacy Principles under the Privacy Act 1988. Ask how the organisation identifies personal information it holds, what controls protect it, and how breaches are managed.
A.5.35 Independent Review of Information Security
The organisation's approach to managing information security and its implementation must be reviewed independently at planned intervals or when significant changes occur. This is essentially a requirement for internal auditing and potentially external review of the ISMS. Check that independent reviews are planned, conducted, and that findings are acted upon.
A.5.36 Compliance with Policies, Rules and Standards for Information Security
Compliance with the organisation's information security policy, topic-specific policies, and standards must be regularly reviewed. This is a self-assessment control. Managers and process owners should be checking that their areas are compliant. Ask for evidence of these reviews, separate from the formal internal audit programme.
A.5.37 Documented Operating Procedures
Operating procedures for information processing facilities must be documented and made available to personnel who need them. This final control in A.5 is about operational documentation. Ask to see procedures for key information processing activities and verify that they are current, accessible, and actually used rather than filed away and forgotten.
How to Audit A.5 Controls Without Getting Overwhelmed
Thirty-seven controls is a lot to cover in a single audit. The practical approach is to use the Statement of Applicability as your starting point. Identify which A.5 controls the organisation has included, then prioritise based on the risk treatment plan and any areas of known concern.
You will not audit every control in depth on every visit. A risk-based sampling approach means you focus more attention on controls that address higher-rated risks or that have a history of weakness. For a surveillance audit, you might sample eight to twelve A.5 controls in depth. For a certification audit, you would expect broader coverage.
When you do audit a control, look for the three elements that distinguish implementation from intention: documented requirements, evidence of operation, and demonstrated effectiveness. A policy document alone satisfies the first element. You need records, interviews, and observation to satisfy the other two. Our article on gathering audit evidence through sampling, interviews and document review covers these techniques in detail.
Pay particular attention to the newer controls introduced in the 2022 revision. Threat intelligence (A.5.7), cloud services (A.5.23), and ICT readiness for business continuity (A.5.30) are areas where many organisations are still maturing their implementation. These are productive areas to probe.
If you want to build your skills in auditing ISMS controls across all four Annex A categories, the ISO 27001 Lead Auditor course at Audit Workshop covers practical audit techniques for each control category, including how to sample efficiently, write findings that hold up, and manage the audit process from planning through to closing meeting.
