ISO 27001
Organizational Controls
37 controls in this category. Click any control to see implementation guidance, evidence requirements, and common audit failures.
A.5.1critical
Policies for information security
Organizational Controls
A.5.10medium
Acceptable use of information and other associated assets
Organizational Controls
A.5.11medium
Return of assets
Organizational Controls
A.5.12high
Classification of information
Organizational Controls
A.5.13medium
Labelling of information
Organizational Controls
A.5.14high
Information transfer
Organizational Controls
A.5.15critical
Access control
Organizational Controls
A.5.16critical
Identity management
Organizational Controls
A.5.17critical
Authentication information
Organizational Controls
A.5.18critical
Access rights
Organizational Controls
A.5.19high
Information security in supplier relationships
Organizational Controls
A.5.2high
Information security roles and responsibilities
Organizational Controls
A.5.20high
Addressing information security within supplier agreements
Organizational Controls
A.5.21high
Managing information security in the ICT supply chain
Organizational Controls
A.5.22high
Monitoring, review and change management of supplier services
Organizational Controls
A.5.23high
Information security for use of cloud services
Organizational Controls
A.5.24critical
Information security incident management planning and preparation
Organizational Controls
A.5.25high
Assessment and decision on information security events
Organizational Controls
A.5.26critical
Response to information security incidents
Organizational Controls
A.5.27high
Learning from information security incidents
Organizational Controls
A.5.28medium
Collection of evidence
Organizational Controls
A.5.29high
Information security during disruption
Organizational Controls
A.5.3high
Segregation of duties
Organizational Controls
A.5.30critical
ICT readiness for business continuity
Organizational Controls
A.5.31critical
Legal, statutory, regulatory and contractual requirements
Organizational Controls
A.5.32medium
Intellectual property rights
Organizational Controls
A.5.33medium
Protection of records
Organizational Controls
A.5.34critical
Privacy and protection of personal identifiable information (PII)
Organizational Controls
A.5.35high
Independent review of information security
Organizational Controls
A.5.36high
Compliance with policies, rules and standards for information security
Organizational Controls
A.5.37medium
Documented operating procedures
Organizational Controls
A.5.4high
Management responsibilities
Organizational Controls
A.5.5medium
Contact with authorities
Organizational Controls
A.5.6low
Contact with special interest groups
Organizational Controls
A.5.7high
Threat intelligence
Organizational Controls
A.5.8high
Information security in project management
Organizational Controls
A.5.9high
Inventory of information and other associated assets
Organizational Controls
Assess ISO 27001 Organizational Controls
Track every control, collect evidence, and generate audit-ready reports with AuditFront.
Start Free AssessmentFree plan · No credit card required