7.3 Annex A Physical (14) and Technological (34) Controls
Key Takeaways
- Physical controls (A.7.1-A.7.14) cover security perimeters, entry controls, physical monitoring (7.4 is new in 2022), equipment siting, utilities, cabling, maintenance, media handling, and secure disposal
- Technological controls (A.8.1-A.8.34) cover user endpoint devices, access control, cryptography, secure coding, configuration management, data masking, DLP, logging, monitoring, clock sync, redundancy, and network separation
- Seven of the eleven 2022 new controls live in the Technological theme, making it the most heavily updated area of Annex A
- A.8.28 Secure coding, A.8.9 Configuration management, A.8.12 Data leakage prevention, and A.8.11 Data masking are frequent exam targets because they reflect modern attack surfaces
- A.7.4 Physical security monitoring was new in 2022 — it formalizes active surveillance (CCTV, intrusion detection) as a distinct control
The Physical and Technological themes of Annex A cover the tangible and technical safeguards of an ISMS. The Physical theme is small (14 controls) and stable; the Technological theme is the second largest (34 controls) and was the most updated area in 2022 — seven of the eleven new controls live here. This section walks through the exam-relevant controls in each theme.
Physical Theme (A.7.1 – A.7.14, 14 controls)
The Physical theme protects the premises, equipment, and physical media that carry information. It is largely a continuation of the 2013 Annex A.11 (Physical and environmental security) domain, with one important 2022 addition (A.7.4 Physical security monitoring).
The 14 Physical Controls — Major Picks
| Control | Title | Exam Angle |
|---|---|---|
| A.7.1 | Physical security perimeters | Sensitive areas behind clearly defined perimeters |
| A.7.2 | Physical entry | Authorized access only; audit trail of entries |
| A.7.3 | Securing offices, rooms and facilities | Physical protection of offices and rooms |
| A.7.4 | Physical security monitoring (NEW 2022) | Active surveillance — CCTV, intrusion detection |
| A.7.5 | Protecting against physical and environmental threats | Fire, flood, earthquake, civil unrest |
| A.7.6 | Working in secure areas | Restrictions on working in sensitive areas |
| A.7.7 | Clear desk and clear screen | Documents locked away; screens auto-locked |
| A.7.8 | Equipment siting and protection | Equipment placed to minimize risk |
| A.7.9 | Security of assets off-premises | Equipment taken off-site requires authorization |
| A.7.10 | Storage media | Inventory, access control, transport of media |
| A.7.11 | Supporting utilities | Power, HVAC, water supply protection |
| A.7.12 | Cabling security | Power and data cabling protected from interception/damage |
| A.7.13 | Equipment maintenance | Maintenance by authorized personnel; insured |
| A.7.14 | Secure disposal or re-use of equipment | Media sanitization before disposal or reuse |
2022 Addition: A.7.4 Physical Security Monitoring
A.7.4 was added to formalize active surveillance of premises using cameras, intrusion detection, and alarms. The 2013 standard implied monitoring through A.11.1 (entry controls) but did not elevate it to its own control. The exam may test this by asking which theme contains the new "Physical security monitoring" control or by asking whether CCTV is covered by Annex A (it is — A.7.4).
Clear Desk and Clear Screen (A.7.7)
A frequent exam topic. The rule has two halves:
- Clear desk: papers and removable media locked away when not in use, especially at end of day.
- Clear screen: computers locked when unattended, automatic lockout after a defined idle period.
Distractors often confuse this with A.5.10 Acceptable use — A.7.7 is specifically about the physical desktop and the screen, not about acceptable use of systems generally.
Secure Disposal or Re-use of Equipment (A.7.14)
All equipment containing storage media must be sanitized before disposal or reuse. The exam tests that simple deletion is insufficient — verified destruction, overwriting, or cryptographic erasure is required, and a certificate of destruction is typically retained as evidence.
Technological Theme (A.8.1 – A.8.34, 34 controls)
The Technological theme covers the system and network controls that protect information in storage, processing, and transmission. This is where most of the 2022 changes concentrate.
Representative Major Controls
| Control | Title | Notes |
|---|---|---|
| A.8.1 | User endpoint devices | Including BYOD; registration, hardening |
| A.8.2 | Privileged access rights | Restricted and logged; least privilege |
| A.8.3 | Information access restriction | Access limited to need-to-know |
| A.8.4 | Access to source code | Read-only for production source; controlled write access |
| A.8.5 | Secure authentication | MFA where appropriate; strong auth factors |
| A.8.6 | Capacity management | Monitor resource use to prevent denial of service |
| A.8.7 | Protection against malware | Anti-malware across endpoints and servers |
| A.8.8 | Management of technical vulnerabilities | Patch management; vulnerability scoring |
| A.8.9 | Configuration management (NEW 2022) | Baselines, hardening, drift management |
| A.8.10 | Information deletion (NEW 2022) | Delete data when no longer needed |
| A.8.11 | Data masking (NEW 2022) | Use masked data in non-production; pseudonymization |
| A.8.12 | Data leakage prevention (NEW 2022) | DLP across endpoints, network, cloud |
| A.8.13 | Information backup | Tested, regular, encrypted backups |
| A.8.15 | Logging | Logging of user, system, admin activities |
| A.8.16 | Monitoring activities (NEW 2022) | Active monitoring for anomalous activity |
| A.8.17 | Clock synchronization | Sync to authoritative time source (e.g., NTP) |
| A.8.18 | Use of privileged utility programs | Restrict use of powerful tools |
| A.8.19 | Installation of software on operational systems | Controlled installation; no unauthorized software |
| A.8.20 | Networks security | Network segmentation, hardening |
| A.8.21 | Security of network services | Service-level security agreements |
| A.8.22 | Segregation of networks | Separate groups of users, services, info on the network |
| A.8.23 | Web filtering (NEW 2022) | Control outbound web access; filter malicious domains |
| A.8.24 | Use of cryptography | Key management, algorithm selection |
| A.8.25 | Secure development life cycle | SSDLC across the lifecycle |
| A.8.26 | Application security requirements | Captured in requirements phase |
| A.8.27 | Secure system architecture and engineering | Secure-by-design principles |
| A.8.28 | Secure coding (NEW 2022) | Secure coding practices, code review, OWASP-style guidance |
| A.8.29 | Security testing in development and acceptance | Pen-test, SAST/DAST before acceptance |
| A.8.30 | Outsourced development | Outsourced code must follow same secure practices |
| A.8.31 | Separation of development, test and production environments | Prevent test data leakage; protect production |
| A.8.32 | Change management | Controlled changes to systems |
| A.8.33 | Test information | Protect test data; do not use live personal data |
| A.8.34 | Protection of information systems during audit planning | Audits must not disrupt operational systems |
The Seven 2022 New Controls in This Theme
Seven of the eleven 2022 new controls live in the Technological theme: 8.9 Configuration management, 8.10 Information deletion, 8.11 Data masking, 8.12 Data leakage prevention, 8.16 Monitoring activities, 8.23 Web filtering, 8.28 Secure coding. Note: A.8.1 User endpoint devices was restructured in 2022 but is not counted as one of the 11 new controls since a similar control existed in the 2013 version.
Exam-Relevant High-Probability Topics
A.8.5 Secure authentication. Authentication should use strong mechanisms; multi-factor authentication is required for higher-risk contexts (remote access, privileged accounts). The exam tests the principle that authentication must be proportional to risk and that passwords alone are increasingly insufficient for sensitive access.
A.8.7 Protection against malware. Anti-malware must be installed, updated, and monitored. The exam may try to trick you with "installed once" — wrong, updates and monitoring are required.
A.8.8 Management of technical vulnerabilities. Vulnerabilities must be identified, evaluated, and treated in a timely manner. The exam tests the triad of identify → evaluate → treat, plus the qualifier timely.
A.8.9 Configuration management (NEW). Hardened configuration baselines must be established, documented, and maintained. Drift from baseline is a defect. This control covers CIS benchmarks, STIGs, and similar frameworks.
A.8.11 Data masking (NEW). Use of masked, anonymized, or pseudonymized data in non-production environments. Directly supports privacy regulation compliance (GDPR Article 25 data protection by design).
A.8.12 Data leakage prevention (NEW). DLP controls across endpoints, network, and cloud to detect and prevent unauthorized exfiltration. The exam tests that DLP is a control category, not a single product.
A.8.15 Logging + A.8.16 Monitoring (NEW). Logging is the recording of events; monitoring is the active analysis of those events. A.8.15 (logging) existed before; A.8.16 (monitoring) was elevated to its own control in 2022. The exam frequently tests the distinction — logging without monitoring is non-conformant.
A.8.17 Clock synchronization. All systems must synchronize to an authoritative time source so that log correlation is possible. A common distractor says clock sync is a network performance matter — it is a security control because forensic value of logs depends on consistent timestamps.
A.8.24 Use of cryptography. Cryptography must be appropriate to the asset's classification, and key management is part of the control — not just algorithm choice.
A.8.28 Secure coding (NEW). Secure coding practices must be applied throughout development, including peer review, testing for common vulnerabilities (injection, XSS, etc.), and use of approved frameworks. Closely tied to A.8.25 Secure development life cycle and A.8.27 Secure system architecture.
Common Exam Traps
- Trap 1 — Confusing logging with monitoring. A.8.15 Logging is recording events; A.8.16 Monitoring is analyzing them. A question that says "logs are reviewed quarterly" may still violate A.8.16 if there is no ongoing monitoring.
- Trap 2 — Treating DLP as a single product. A.8.12 is a control category covering endpoint, network, and cloud DLP. The exam may offer "install DLP software on endpoints" as the answer — it is partial.
- Trap 3 — Saying A.7.4 Physical security monitoring existed in 2013. It did not. It is one of the 11 new 2022 controls.
- Trap 4 — Confusing clear desk/clear screen with acceptable use. A.7.7 is specifically the physical desk and screen state; acceptable use is A.5.10.
- Trap 5 — Treating patch management as A.8.9 Configuration management. Patch management lives in A.8.8 Management of technical vulnerabilities; A.8.9 is about baseline configurations and drift, not patch delivery.
- Trap 6 — Saying encryption alone satisfies A.8.24. A.8.24 requires both appropriate cryptography and appropriate key management. Encryption with mishandled keys is non-conformant.
Key Takeaways
- Physical theme (A.7.1-A.7.14, 14 controls) covers perimeters, entry, monitoring, equipment, media, and disposal; A.7.4 Physical security monitoring is new in 2022.
- Technological theme (A.8.1-A.8.34, 34 controls) holds seven of the eleven new 2022 controls, including 8.9, 8.10, 8.11, 8.12, 8.16, 8.23, 8.28.
- Logging (A.8.15) and Monitoring (A.8.16) are distinct controls — recording events vs. actively analyzing them.
- A.8.24 Use of cryptography requires both appropriate algorithms and key management.
- Patch management is A.8.8, not A.8.9 Configuration management.
Which Annex A control was newly introduced in ISO/IEC 27001:2022 to address active surveillance of premises using cameras and intrusion detection?
An organization collects system logs from all servers but does not actively review or alert on them. Which Annex A control is most directly not being met?
When an organization applies encryption to protect sensitive data but stores the decryption keys in the same database as the ciphertext, which Annex A control is being violated in spirit?