Annex A Controls

How many controls does Annex A of ISO/IEC 27001:2022 contain?

• A114
• B93✓
• C75
• D133

Answer: The 2022 edition has 93 controls, down from 114 in the 2013 edition: 11 are new, 24 were merged and the rest were renamed or restructured.

Into how many themes are the ISO/IEC 27001:2022 Annex A controls grouped?

• AFourteen
• BSeven
• CFour✓
• DEleven

Answer: The 2022 edition groups the 93 controls into four themes: organisational, people, physical and technological. The 2013 edition used fourteen clauses instead.

Which four themes group the Annex A controls in ISO/IEC 27001:2022?

• AConfidentiality, integrity, availability, resilience
• BPreventive, detective, corrective, recovery
• CGovernance, risk, compliance, assurance
• DOrganisational, people, physical, technological✓

Answer: The four themes are organisational (A.5), people (A.6), physical (A.7) and technological (A.8). The other groupings describe control function or security properties, which are attributes rather than themes.

How many controls are new in ISO/IEC 27001:2022 compared with the 2013 edition?

• A24
• B93
• C11✓
• D35

Answer: Eleven controls are genuinely new. Twenty-four were merged from existing controls, which is a different change and a common distractor.

Which of these is one of the eleven new controls introduced in ISO/IEC 27001:2022?

• AThreat intelligence✓
• BAccess control
• CIncident management
• DSegregation of duties

Answer: Threat intelligence (A.5.7) is one of the eleven new controls. Access control, incident management and segregation of duties all existed in the 2013 edition in some form.

Which new 2022 control addresses the organisation’s ability to keep information and communications technology available through a disruption?

• ABusiness impact analysis
• BRedundancy of information processing facilities
• CICT readiness for business continuity✓
• DInformation security continuity

Answer: ICT readiness for business continuity (A.5.30) is new in 2022. It is narrower than general business continuity: it addresses the ICT capability specifically, and its arrival is part of the edition assuming prevention will sometimes fail.

Which new 2022 control covers the obscuring of data so that it can be used without exposing the original values?

• AInformation deletion
• BCryptography
• CData leakage prevention
• DData masking✓

Answer: Data masking (A.8.11) is one of the eleven new controls. Data leakage prevention (A.8.12) and information deletion (A.8.10) are also new but address different problems.

An organisation wants to restrict which external websites staff can reach. Which 2022 Annex A control applies?

• AData leakage prevention
• BAccess control
• CWeb filtering✓
• DNetwork security

Answer: Web filtering (A.8.23) is a new 2022 control covering management of access to external websites to reduce exposure to malicious content. It is more specific than the general access control and network security controls.

How many attributes does ISO/IEC 27002:2022 associate with each control?

• AFour
• BEleven
• CFive✓
• DThree

Answer: ISO/IEC 27002:2022 gives each control five attributes: control type, information security properties, cybersecurity concepts, operational capabilities and security domains. They support filtering and are guidance rather than a requirement of 27001.

Where are the five control attributes defined?

• AISO/IEC 27000
• BISO/IEC 27001 Annex A
• CISO/IEC 27002✓
• DISO/IEC 27005

Answer: The attributes come from ISO/IEC 27002:2022, not from 27001 itself. Annex A of 27001 lists the controls; 27002 supplies the implementation guidance and the attribute scheme.

Which Annex A theme contains the largest number of controls in ISO/IEC 27001:2022?

• AOrganisational✓
• BPeople
• CTechnological
• DPhysical

Answer: The organisational theme (A.5) is the largest at 37 controls, ahead of technological (A.8) at 34. People (A.6) has 8 and physical (A.7) has 14.

An implementation team needs detailed guidance on how to implement the Annex A control for privileged access rights. Which document should they consult?

• AISO/IEC 27002, which provides implementation guidance for each control✓
• BISO/IEC 27005, which sets out control implementation for access risks
• CISO/IEC 27001 Annex A, which specifies the implementation steps
• DISO/IEC 27006, which describes control implementation for auditors

Answer: Annex A names each control and states its objective in a single line; it does not say how to implement it. ISO/IEC 27002 is the companion standard that gives purpose, guidance and other information for every one of the 93 controls.

Which Annex A theme would a control on secure disposal of storage media belong to?

• APeople
• BOrganisational
• CTechnological
• DPhysical✓

Answer: Controls concerned with equipment, media and the physical environment sit under the physical theme (A.7). The technological theme covers the systems and services themselves.

Which Annex A theme covers screening, terms of employment and disciplinary process?

• APhysical
• BPeople✓
• CTechnological
• DOrganisational

Answer: The people theme (A.6) covers controls attached to individuals: screening, terms and conditions, awareness, disciplinary process and responsibilities after termination.

A control is described as both technical in nature and preventive in type. How should that be understood?

• ANature and control type are separate classifications, so both labels apply at once✓
• BA control carries exactly one classification, so one of the two is wrong
• CBoth labels apply only where the Statement of Applicability records them
• DBoth labels apply only to controls within the technological theme

Answer: Control type, in ISO/IEC 27002:2022, describes how a control acts: preventive, detective or corrective. Nature describes what kind of control it is: administrative, technical, physical or legal. Both labels are true of the same control at once, and questions that present them as alternatives are testing exactly this.

What must an organisation do about an Annex A control it decides not to implement?

• AReplace it with a control from ISO/IEC 27002
• BObtain written approval from the certification body
• CJustify its exclusion in the Statement of Applicability✓
• DRemove it from the risk assessment

Answer: Because Annex A is normative, the Statement of Applicability must account for every control: those that are necessary, why, whether they are implemented, and the justification for excluding any that are not.