The standard doesn’t require all controls to be implemented, these will likely be different for each organisation and identified during the risk assessment stage. Annex A has 114 controls in total which are grouped into 14 families. Below is a list of all the control sets: A.5 Information Security Policies A.6 Organisation of Information Security A.7 Human Resource Security A.8 Asset Management A.9 Access Control A.10 Cryptography A.11 Physical and Environmental Security A.12 Operations Security A.13 Communications Security A.14 System Acquisition, Development and Maintenance A.15 Supplier Relationships A.16 Information Security Incident Management A.17 Information Security Aspects of Business Continuity Management A.18 Compliance However, ISO 27001 is likely to have fewer controls, 93 in fact, to help simplify processes.