Annex A (94)

1. Organizational Controls (37 controls): policies, procedures, and organizational-level measures.
2. People Controls (8 controls): human component of information security, including awareness, training, and personnel security.
3. Physical Controls (14 controls): physical environment and security of tangible assets.
4. Technological Controls (34 controls): technical measures such as malware protection, backups, and network security.

A 5 Organizational Controls (37)

A 6 People Controls (8)

A 7 Physical Controls (14)

A 8 Technological Controls (34)