ISO/IEC 27001:2022 + Amd 1:2024
World's most widely adopted ISMS standard. 93 Annex A controls in 4 themes (Organizational, People, Physical, Technological). 2024 climate amendment adds environmental context to clauses 4.1 and 4.2 — Annex A unchanged. Three-year transition from ISO 27001:2013 closed 31 October 2025; all current certifications now on 2022 edition.
Composition
93 controls currently indexed; participates in 52 cross-framework synthesis clusters.
Participates in synthesis
Each cluster listed below combines this framework's controls with operationally equivalent controls from other frameworks, resolving the overlap into a single audit-defensible specification.
- Anti-malware protection with EDR and email/web safeguards
- Authentication architecture and multi-factor authentication
- Board-approved policy framework anchoring derived operational controls (legacy "supplier-policy" cluster name)
- Board-approved security policy framework — IS policy, cyber security policy, and derived operational policies
- Board-level IT/IT Strategy Committee with documented charter
- Business continuity and ICT recovery readiness
- Centralised logging with retention, tamper protection, and integrity
- Change management — IT systems, configuration, supplier services, risk
- Cloud Identity and Access Management — federation, vulnerability testing, monitoring
- Cloud cryptographic key management — CMK/BYOK/HYOK
- Comprehensive asset inventory with classification and ownership
- Continuous monitoring of networks, systems, applications, and outsourced development
- Cryptographic controls, key management, and post-quantum readiness
- Cyber resilience metrics — KPIs, KRIs, Board reporting cadence
- Cyber risk assessment — technology, process, people, third-party, supply chain, post-quantum
- Cyber security roles, responsibilities, and authority — Board through operational team
- Data Loss Prevention — multi-channel egress protection
- Data classification with protection controls — DLP, masking, retention, secure disposal
- Data-at-rest protection — encryption, access, processor controls
- DevSecOps maturity — security-as-code, pipeline-enforced controls, API security
- Encryption at rest — sensitive data and key management
- Encryption at rest — sensitive data and key management
- Event-to-incident categorisation and assessment
- Forensic capability and evidence collection
- Incident response execution — detection through eradication, recovery, and lessons learned
- Incident response plan preparation, independent review, and risk-response planning
- Logical and physical access restriction — least privilege baseline
- Mandatory assurance regime — periodic audit, VAPT, third-party assessment, risk review
- Multi-factor authentication — universal MFA across access types
- Multi-regulator incident notification with coordinated submission timelines
- Network protection — segmentation, monitoring, perimeter, and data leak prevention
- Network segmentation with zero-trust principles
- PCI DSS PAN protection — storage minimisation, masking, encryption
- PCI DSS Targeted Risk Analysis (TRA) — flexibility and customised approach
- PCI DSS e-skimming protection — payment page script integrity
- PCI DSS v4.0.1 customised approach with targeted risk analysis
- PCI DSS v4.0.1 universal MFA expansion to all CDE access
- PIMS context — Clauses 4-5 management system context and leadership
- Personal data erasure — trigger-driven with propagation
- Physical access controls — secure areas, entry monitoring, asset protection
- Privacy governance — legal, regulatory, contractual, and algorithmic obligations
- Privileged access management and access rights lifecycle
- Processing integrity — change management, redundancy, clock synchronisation, storage integrity
- Ransomware-resilient backup architecture
- Secure SDLC — threat modelling, secure coding, SAST/DAST, dependency scanning, DevSecOps
- Secure configuration baselines and hardening discipline
- Secure disposal of equipment, media, and personal information
- Security reporting governance — CISO, DPO, incident reporting, compliance reporting
- Software installation discipline — authorised software, configuration, source code access
- Vulnerability management programme — discovery, prioritisation, remediation
- Workforce security awareness, role-based training, and human-factor controls
- Zero Trust Architecture — never trust, always verify