ISO 27001 Annex A.5 and A.6 Controls for Australia

Why organisational and people controls are the foundation of ISO 27001

Technical controls — firewalls, encryption, patch management — only deliver their intended security value when underpinned by sound governance and human behaviour. ISO 27001:2022, published by the International Organization for Standardization (ISO), restructured its Annex A controls into four domains. Two of those domains — Annex A.5 (Organisational Controls) and Annex A.6 (People Controls) — account for 45 of the 93 controls in the standard.

Industry breach analysis — notably the Verizon Data Breach Investigations Report — consistently finds that a large proportion of security incidents involve a human element, whether through misconfiguration, social engineering, or policy non-compliance. For Australian organisations pursuing ISO 27001 certification, Annex A.5 and A.6 are frequently the domains with the most remediation work — and the most common sources of non-conformances at certification audit.

This article provides a practical guide to both domains: what each control requires, how to prioritise implementation, what documentation auditors expect, and how these controls align with the ACSC Essential Eight and the Privacy Act 1988.

1. Understanding Annex A.5 — the 37 organisational controls

ISO 27001:2022 Annex A.5 covers the governance structures, policies, and organisational processes that define how information security is managed at an enterprise level. The 37 controls span six broad themes.

Policies and governance (A.5.1 – A.5.3):

• A.5.1 Policies for information security: The organisation must define, approve, publish, and communicate an information security policy. ISO/IEC 27002:2022 guidance requires the policy to be reviewed at planned intervals and whenever significant changes occur.
• A.5.2 Information security roles and responsibilities: Roles must be defined and assigned, with a named individual accountable for the ISMS. Many Australian organisations appoint a CISO or Information Security Manager to fulfil this role.
• A.5.3 Segregation of duties: Conflicting duties and areas of responsibility must be separated to reduce fraud and error risk, particularly relevant in financial services and government contexts.

Risk and threat intelligence (A.5.7 – A.5.8):

• A.5.7 Threat intelligence: New in ISO 27001:2022, this control requires organisations to gather and analyse information on threats. The ACSC Threat Intelligence Sharing (CTIS) platform is a practical source for Australian organisations complying with this control.
• A.5.8 Information security in project management: Information security must be integrated into project management practices, ensuring security requirements are addressed from project initiation.

Information classification and handling (A.5.9 – A.5.14):

• A.5.9 Inventory of information and other associated assets: Maintain an asset register covering information assets, hardware, software, and services.
• A.5.10 Acceptable use of information and other assets: Define and communicate acceptable use policies. Australian government organisations should align these with the Protective Security Policy Framework (PSPF).
• A.5.12 Classification of information: Implement an information classification scheme. Australian government organisations — and many others that align to it — use the Protective Security Policy Framework (PSPF) classifications: OFFICIAL and OFFICIAL: Sensitive for most business information, and PROTECTED for more sensitive information (with SECRET and TOP SECRET reserved for national security information above these).
• A.5.13 Labelling of information: Classified information must be labelled in accordance with the classification scheme, both in physical and digital form.
• A.5.14 Information transfer: Policies covering transfer of information must address confidentiality agreements, secure transmission, and physical media security.

Supplier and third-party controls (A.5.19 – A.5.23): Supply chain compromise is a growing source of risk for Australian organisations, including operators of critical infrastructure. ISO 27001 A.5.19 through A.5.23 address this directly.

• A.5.19 Information security in supplier relationships: Identify and document security requirements for suppliers with access to organisational information or systems.
• A.5.20 Addressing information security within supplier agreements: Include specific security clauses in contracts, covering data protection, incident notification timeframes, audit rights, and sub-processor management.
• A.5.21 Managing information security in the ICT supply chain: Assess and monitor security controls across the ICT supply chain, particularly for cloud services and managed service providers.
• A.5.23 Information security for use of cloud services: Specifically addresses cloud service acquisition, use, and exit — directly relevant to Australian organisations using Microsoft 365, Azure, or AWS.

Incident management governance (A.5.24 – A.5.28):

• A.5.24 Information security incident management planning and preparation: Establish incident management responsibilities and procedures before an incident occurs. Under the Notifiable Data Breaches (NDB) scheme administered by the OAIC (OAIC — Notifiable Data Breaches scheme, accessed 16 June 2026), Australian organisations have up to 30 days to assess a suspected eligible data breach after becoming aware of it and, where it is an eligible breach, must notify affected individuals and the OAIC as soon as practicable. ISO 27001 A.5.24 must incorporate these NDB assessment and notification timelines.
• A.5.25 Assessment and decision on information security events: Classify and prioritise security events to determine whether they constitute incidents requiring formal response.
• A.5.26 Response to information security incidents: Execute documented response procedures, preserve evidence, and maintain communication logs.
• A.5.27 Learning from information security incidents: Conduct post-incident reviews and update controls accordingly. This feeds directly into the continual improvement requirement of ISO 27001 Clause 10.

Business continuity and legal compliance (A.5.29 – A.5.37):

• A.5.29 Information security during disruption: Ensure information security controls remain effective during disruption, linking to broader business continuity plans.
• A.5.33 Protection of records: Records must be protected from loss, destruction, falsification, and unauthorised access, with retention periods defined. This aligns with the Privacy Act 1988 APP 11 requirement to take reasonable steps to protect personal information.
• A.5.36 Compliance with policies, rules, and standards: Regular reviews must confirm compliance with the ISMS policy and standards — typically performed by internal audit.

2. Understanding Annex A.6 — the 8 people controls

ISO 27001:2022 Annex A.6 focuses on the human dimension of information security. The 8 controls cover the entire employee lifecycle from recruitment through termination, plus remote working.

Pre-employment controls (A.6.1 – A.6.2):

• A.6.1 Screening: Background verification checks must be proportionate to the role, business requirements and the information personnel will access. Australian organisations should document the lawful basis and purpose for collecting screening information, notify candidates about the collection, and dispose of personal information when it is no longer required under applicable law and policy.
• A.6.2 Terms and conditions of employment: Employment contracts must include information security responsibilities. This includes confidentiality obligations, acceptable use acknowledgements, and the requirement to report incidents. Employees must sign these terms before accessing organisational systems.

During-employment controls (A.6.3 – A.6.5):

• A.6.3 Information security awareness, education, and training: All personnel must receive regular, role-appropriate security awareness training. Organisations that deliver role-based training rather than generic annual modules generally see lower phishing susceptibility. Security awareness training is not one of the ACSC Essential Eight mitigation strategies, but documented, role-appropriate training is a core ISO 27001 people control and sound general practice — retain completion records as evidence of the control operating.
• A.6.4 Disciplinary process: A formal disciplinary process for information security policy violations must exist and be communicated. Employees must understand that violations carry consequences — this deters negligent behaviour as much as intentional misuse.
• A.6.5 Responsibilities after termination or change of employment: Information security obligations do not end at resignation. Confidentiality agreements, intellectual property restrictions, and restrictions on use of organisational information must extend post-employment.

Offboarding control (A.6.6):

• A.6.6 Confidentiality or non-disclosure agreements: Separate or embedded NDAs must cover all personnel and relevant third parties who access sensitive information. These must be reviewed and re-signed when roles change significantly.

Remote working (A.6.7 – A.6.8):

• A.6.7 Remote working: Organisations must implement policies and controls for remote working, covering device security, network access, physical security of work environments, and protection of information accessed remotely. Select controls from the organisation's risk assessment and technology design instead of assuming that one access mechanism is suitable for every environment.
• A.6.8 Information security event reporting: All personnel must be required and enabled to report suspected information security events. Reporting channels must be clear, accessible, and free from fear of reprisal. Employees are frequently the first to notice a security incident, ahead of automated monitoring systems — making A.6.8 a critical early warning mechanism.

3. Implementation priorities for Australian organisations

Not all 45 controls carry equal risk or audit weight. Based on common certification audit patterns and implementation guidance, Australian organisations should prioritise in the following sequence.

Priority 1 — Governance foundation (Weeks 1–6):

• Draft and approve information security policy (A.5.1)
• Assign named roles and responsibilities (A.5.2)
• Develop information classification scheme (A.5.12)
• Create information asset register (A.5.9)
• Establish incident management procedure incorporating NDB timelines (A.5.24)

Priority 2 — People controls lifecycle (Weeks 4–10):

• Review and update employment contracts to include security obligations (A.6.2)
• Deploy role-based security awareness training programme (A.6.3)
• Document and communicate disciplinary procedure (A.6.4)
• Create offboarding checklist covering access revocation and asset return (A.5.11, A.6.5)
• Establish incident reporting channel with feedback loop (A.6.8)

Priority 3 — Supply chain and advanced controls (Weeks 8–16):

• Audit existing supplier contracts for security clauses; update where absent (A.5.19, A.5.20)
• Implement cloud service security assessment process (A.5.23)
• Deploy threat intelligence subscription (ACSC CTIS or commercial feed) to satisfy A.5.7
• Formalise remote working policy and endpoint control requirements (A.6.7)

4. Documentation requirements for audit readiness

Certification auditors — whether from BSI, SAI Global, Bureau Veritas, or SGS — apply the same evidence standards. The following documents are mandatory for A.5 and A.6 compliance.

Required for Annex A.5:

• Current information security policy with executive signature, version number, and review date
• Statement of Applicability (SoA) documenting rationale for each control decision
• Information asset register with classification, owner, and location fields
• Supplier security questionnaire results and contract security schedules
• Incident log with classification, response timeline, and lessons-learned records
• Internal audit report covering compliance with A.5 controls

Required for Annex A.6:

• Pre-employment screening policy with privacy consent form template
• Employment contract template including information security clauses
• Training completion records with role-based training matrices
• Disciplinary procedure document with evidence of employee communication
• Offboarding checklist template with completed records for recent leavers
• Incident reporting channel documentation and evidence of awareness communication

A common pattern in Stage 2 audits is that non-conformances relate to missing or outdated evidence rather than absent controls — meaning the controls often exist but are not documented consistently.

5. Common audit findings in A.5 and A.6

Understanding the most common failure points allows proactive remediation before the certification audit.

Top A.5 audit findings:

• Information security policy lacks a review date or has not been reviewed within the committed cycle
• No formal process for classifying information — assets exist without classification labels
• Supplier contracts reference general confidentiality but lack specific information security obligations, audit rights, or incident notification timeframes
• Incident management procedure references NDB reporting but does not include internal escalation timelines or evidence of plan testing

Top A.6 audit findings:

• Employment contracts predating the ISMS implementation do not include information security clauses — legacy staff contracts are the most common gap
• Training records show completion of generic security awareness but lack role-specific modules for privileged users or developers
• No documented offboarding checklist — access revocation is ad hoc and unverifiable
• Incident reporting channel exists (e.g., a shared mailbox) but no evidence that employees have been made aware of it within the last 12 months

6. Alignment with ACSC Essential Eight and ISM

Australian organisations implementing ISO 27001 Annex A.5 and A.6 gain significant overlap with ACSC guidance, reducing total compliance effort.

Essential Eight alignment:

• Restrict administrative privileges (Control 5): Maps to A.5.2 (role assignment) and A.5.15 (access control). A formal roles and responsibilities matrix satisfies both standards.
• Regular backups (Control 8): Maps to A.5.29 (information security during disruption) and A.5.33 (protection of records).
• Security awareness training: Although not one of the eight Essential Eight mitigation strategies, documented, role-appropriate awareness training is widely recommended alongside the Essential Eight's technical controls and maps to ISO 27001 A.6.3. A single training programme can provide evidence for A.6.3 while supporting broader security culture.
• Multi-factor authentication (Control 7): Maps to A.5.17 (authentication information management) — A.5 requires controls on authentication; Essential Eight specifies MFA as the mechanism.

ISM alignment: The Australian Signals Directorate's Information Security Manual (ISM) (ACSC — Information Security Manual, accessed 3 November 2026) includes related governance and personnel controls. ISM-1997 requires boards or executive committees to define clear cyber security roles and responsibilities, while ISM-0434 requires appropriate employment screening before personnel receive access to systems and resources. These controls overlap with A.5.2 and A.6.1, but organisations must assess each framework independently rather than treating ISO 27001 implementation as automatic ISM compliance.

Privacy Act 1988 alignment: The Privacy Act 1988 Australian Privacy Principles (OAIC — Australian Privacy Principles, accessed 16 June 2026) impose obligations that intersect with multiple A.5 and A.6 controls:

• APP 1 (open and transparent management) aligns with A.5.1 (information security policy)
• APP 3 (collection of personal information) and APP 5 (notification) align with A.6.1 (screening procedures)
• APP 11 (security of personal information) aligns with A.5.33 (protection of records) and A.5.12 (information classification)
• The NDB scheme reporting timeline aligns with A.5.24 and A.5.26 (incident management and response)

The OAIC's privacy management framework describes governance, accountability and review practices that can be coordinated with an ISMS. That coordination can reduce duplicated evidence, but ISO 27001 certification does not itself demonstrate Privacy Act compliance.

7. Before and after implementing A.5 and A.6

Before implementation:

• Information security policy exists but is undated, unsigned, and stored in a shared drive nobody reads
• Employment contracts reference confidentiality in one line with no specific security obligations
• Security awareness is an annual 20-minute generic video with no completion tracking
• Supplier relationships are governed by procurement-only contracts with no security clauses
• Incidents are handled reactively with no documented procedure, no NDB timeline awareness, and no lessons-learned process

After implementation:

• A current, executive-approved information security policy is published on the intranet, reviewed annually, and version-controlled
• All employment contracts include a dedicated information security schedule signed at onboarding, with legacy contracts updated on a rolling basis
• Security awareness uses a role-tiered programme: all-staff annual baseline plus quarterly targeted modules for privileged users, with completion records exported to the ISMS evidence repository
• Supplier security assessments are mandatory for all third parties with data access, with security schedules embedded in contracts and annual review obligations
• An incident management procedure covers classification, response, and NDB handling under the Privacy Act 1988 (assessing a suspected eligible breach within 30 days and notifying as soon as practicable where required), and mandatory post-incident review

Call to action

ISO 27001:2022 Annex A.5 and A.6 form the governance and human foundation of any effective ISMS. For Australian organisations, these controls also directly address Privacy Act 1988 obligations, ACSC Essential Eight requirements, and ISM alignment — making them among the highest-ROI implementation areas for a certification programme.

The most common cause of certification failure is not absent controls but absent evidence. Starting documentation practices early — particularly for training records, incident logs, and supplier security assessments — dramatically reduces audit risk.

Next steps: Conduct a targeted gap assessment against A.5 and A.6 controls before committing to a full certification programme. This identifies priority remediation items and supports a realistic implementation plan before the Stage 1 audit. Enrol your security team in structured compliance and governance training to build the internal capability needed to sustain the ISMS beyond initial certification.

Sources referenced in this article: OAIC Notifiable Data Breaches scheme; OAIC Australian Privacy Principles; ACSC Information Security Manual (ISM); ACSC Essential Eight Maturity Model; ISO 27001:2022 / ISO/IEC 27002:2022; ISACA CISM guidelines; Verizon Data Breach Investigations Report; ACSC Threat Intelligence Sharing (CTIS) platform; ASD Protecting Against Cyber Threats to Operational Technology guidance 2023; OAIC Privacy management framework 2023; SAI Global, Bureau Veritas and SGS certification bodies; Protective Security Policy Framework (PSPF).