Normative list of controls that accompanies ISO/IEC 27001. The 2022 version contains 93 controls grouped into four categories. The organisation must justify the inclusion or exclusion of each control in its statement of applicability (SoA).