How to Comply with ISO/IEC 27001:2022
ISO/IEC 27001:2022 is the international standard for information security management systems (ISMS). It specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS, with Annex A controls covering organizational, people, physical, and technological security measures.
100%
Coverage
49
Controls Required
0
Not Applicable
Why ISO 27001 Compliance Matters
ISO/IEC 27001:2022 certification is recognized globally and often required for international business, enterprise sales, and government contracts. Achieving certification requires implementing an Information Security Management System (ISMS) and passing an external audit. The Annex A controls mapped here form the core implementation requirements.
Compliance Checklist by Domain
The 49 controls below are mapped to ISO 27001 requirements. Work through each domain to build your compliance program.
Govern (6 controls)
| Control | ISO 27001 References | Also In |
|---|---|---|
| Governance Policy | A.5.1 A.5.2 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Risk Management | A.5.3 A.8.2 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Supply Chain Risk | A.5.19 A.5.21 | NIST CSF 2.0, SOC 2, PCI DSS, 800-53, HIPAA, GDPR |
| Roles & Responsibilities | A.5.2 A.5.4 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Compliance | A.5.31 A.5.36 | NIST CSF 2.0, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Vendor Risk Mgmt | A.5.19 A.5.20 A.5.21 A.5.22 | NIST CSF 2.0, SOC 2, PCI DSS, 800-53, HIPAA, GDPR |
Identify (6 controls)
| Control | ISO 27001 References | Also In |
|---|---|---|
| Asset Management | A.5.9 A.8.1 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Risk Assessment | A.8.2 A.8.3 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Business Environment | A.5.1 | NIST CSF 2.0, SOC 2, PCI DSS, 800-53, HIPAA, GDPR |
| Data Classification | A.5.10 A.5.12 A.5.13 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Vulnerability Mgmt | A.8.8 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Threat Intelligence | A.5.7 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53 |
Protect (21 controls)
| Control | ISO 27001 References | Also In |
|---|---|---|
| Awareness & Training | A.6.3 A.7.2 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Access Control | A.5.15 A.8.2 A.8.3 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Multi-Factor Auth | A.8.5 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Encryption | A.8.24 A.5.14 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Data Protection | A.5.14 A.8.10 A.8.12 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Backup & Recovery | A.8.13 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Privileged Access | A.8.2 A.8.18 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Firewall / Net Seg | A.8.20 A.8.21 A.8.22 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Endpoint Protection | A.8.1 A.8.7 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Patch Management | A.8.8 A.8.19 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Secure Config | A.8.9 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Secure Development | A.8.25 A.8.26 A.8.28 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, GDPR |
| Email Security | A.8.7 A.8.23 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Web Security | A.8.23 A.8.26 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Zero Trust | A.8.20 A.5.15 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Mobile Security | A.8.1 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Cloud Security | A.5.23 A.8.1 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| DNS Security | A.8.20 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53 |
| WAF | A.8.23 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| DLP | A.8.10 A.8.12 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| API Security | A.8.23 A.8.26 A.8.28 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
Detect (6 controls)
| Control | ISO 27001 References | Also In |
|---|---|---|
| Cont. Monitoring | A.8.15 A.8.16 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Logging & Audit | A.8.15 A.8.17 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Intrusion Detection | A.8.16 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Anomaly Detection | A.8.16 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| SIEM / SOC | A.8.15 A.8.16 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Insider Threat | A.5.7 A.6.1 A.8.15 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
Respond (5 controls)
| Control | ISO 27001 References | Also In |
|---|---|---|
| Incident Response | A.5.24 A.5.25 A.5.26 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Forensics | A.5.28 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Communication | A.5.5 A.5.6 A.5.26 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Mitigation | A.5.26 A.8.7 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Reporting | A.5.5 A.5.24 A.6.8 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
Recover (5 controls)
| Control | ISO 27001 References | Also In |
|---|---|---|
| Recovery Planning | A.5.29 A.5.30 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Business Continuity | A.5.29 A.5.30 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Lessons Learned | A.5.27 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Comms & Restore | A.5.5 A.5.30 | NIST CSF 2.0, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
| Disaster Recovery | A.5.29 A.5.30 | NIST CSF 2.0, CIS v8, SOC 2, PCI DSS, CMMC, 800-53, HIPAA, GDPR |
How ISO 27001 Compares
See how ISO 27001 coverage overlaps with other frameworks: