ISMS audit — Annex A controls (ISO/IEC 27001:2022)
Full audit of the information security management system (ISMS) covering the 93 controls of Annex A of ISO/IEC 27001:2022, grouped into four themes: organisational (A.5), people (A.6), physical (A.7) and technological (A.8) controls. Each control is rated Compliant / Non-compliant / N/A with an automatic compliance score, flagging of gaps and per-chapter compliance. Each requirement is anchored to its clause (A.5.x to A.8.x) to produce a structured report usable in management review or in preparation for certification. Wording reformulated, without reproducing the protected normative text.
- control points
- 100
- anchored clauses
- 93
- Clauses covered
- 4
Clauses covered
| Organisational controls (A.5) | 37 | A.5.1 · A.5.2 · A.5.3 · A.5.4 · A.5.5 · A.5.6 · A.5.7 · A.5.8 · A.5.9 · A.5.10 · A.5.11 · A.5.12 · A.5.13 · A.5.14 · A.5.15 · A.5.16 · A.5.17 · A.5.18 · A.5.19 · A.5.20 · A.5.21 · A.5.22 · A.5.23 · A.5.24 · A.5.25 · A.5.26 · A.5.27 · A.5.28 · A.5.29 · A.5.30 · A.5.31 · A.5.32 · A.5.33 · A.5.34 · A.5.35 · A.5.36 · A.5.37 |
| People controls (A.6) | 8 | A.6.1 · A.6.2 · A.6.3 · A.6.4 · A.6.5 · A.6.6 · A.6.7 · A.6.8 |
| Physical controls (A.7) | 14 | A.7.1 · A.7.2 · A.7.3 · A.7.4 · A.7.5 · A.7.6 · A.7.7 · A.7.8 · A.7.9 · A.7.10 · A.7.11 · A.7.12 · A.7.13 · A.7.14 |
| Technological controls (A.8) | 34 | A.8.1 · A.8.2 · A.8.3 · A.8.4 · A.8.5 · A.8.6 · A.8.7 · A.8.8 · A.8.9 · A.8.10 · A.8.11 · A.8.12 · A.8.13 · A.8.14 · A.8.15 · A.8.16 · A.8.17 · A.8.18 · A.8.19 · A.8.20 · A.8.21 · A.8.22 · A.8.23 · A.8.24 · A.8.25 · A.8.26 · A.8.27 · A.8.28 · A.8.29 · A.8.30 · A.8.31 · A.8.32 · A.8.33 · A.8.34 |
Scale
This template is used inside the platform: every finding becomes a corrective action tracked through to its evidence — something a printed grid cannot do.
Use this template14-day trial, no credit card. The template opens in your workspace.
How this grid is built
Every control point is written in our own words, then tied to the standard's clause number. The normative text is never reproduced: the standard itself remains to be purchased from the body that publishes it. Grids are reviewed at every new edition of a standard.
Published by NormePulse — HEMC, management consulting firmUpdated