#iso27001/2013
# Annex A (normative) Reference control objectives and controls

The control objectives and controls listed in Table A.1 are directly derived from and aligned with those listed in ISO/IEC 27002:2013[^1 ], Clauses 5 to 18 and are to be used in context with Clause 6.1.3.

[ISO 27001 A 5 Information security policies](ISO%2027001%20A%205%20Information%20security%20policies.md)
[ISO 27001 A 6 Organization of information security](ISO%2027001%20A%206%20Organization%20of%20information%20security.md)
[ISO 27001 A 7 Human resource security](ISO%2027001%20A%207%20Human%20resource%20security.md)
[ISO 27001 A 8 Asset management](ISO%2027001%20A%208%20Asset%20management.md)
[ISO 27001 A 9 Access control](ISO%2027001%20A%209%20Access%20control.md)
[ISO 27001 A 10 Cryptography](ISO%2027001%20A%2010%20Cryptography.md)
[ISO 27001 A 11 Physical and environmental security](ISO%2027001%20A%2011%20Physical%20and%20environmental%20security.md)
[ISO 27001 A 12 Operations security](ISO%2027001%20A%2012%20Operations%20security.md)
[ISO 27001 A 13 Communications security](ISO%2027001%20A%2013%20Communications%20security.md)
[ISO 27001 A 14 System acquisition, development and maintenance](ISO%2027001%20A%2014%20System%20acquisition,%20development%20and%20maintenance.md)
[ISO 27001 A 15 Supplier relationships](ISO%2027001%20A%2015%20Supplier%20relationships.md)
[ISO 27001 A 16 Information security incident management](ISO%2027001%20A%2016%20Information%20security%20incident%20management.md)
[ISO 27001 A 17 Information security aspects of business continuity management](ISO%2027001%20A%2017%20Information%20security%20aspects%20of%20business%20continuity%20management.md)
[ISO 27001 A 18 Compliance](ISO%2027001%20A%2018%20Compliance.md)



Possible distinction to avoid the 'snake biting its own tail' problem:
- controls that are associated with the ISMS process 
- controls that are used to mitigate risks on assets



Related:
- [ISO_27001_2013_EN_Index](ISO_27001_2013_EN_Index.md)