ISO 27001 Annex A: Which Controls Can Be Automated?

ISO 27001:2022 Annex A Controls: Which Ones Can Be Automated with CIS Scanning?

ISO 27001:2022 is the international gold standard for information security management systems (ISMS). Its updated Annex A contains 93 controls organized into four themes: Organizational (37), People (8), Physical (14), and Technological (34). For organizations pursuing or maintaining certification, demonstrating implementation and ongoing effectiveness of these controls is the central challenge.

A question that consistently arises in ISMS implementation projects is: which controls can be automated, and how? CIS Benchmark scanning provides a direct, evidence-based mechanism for automating a significant subset of Annex A controls -- particularly the 34 technological controls that deal with system configurations, access management, logging, and network security.

This guide maps the ISO 27001:2022 Annex A controls to CIS Benchmark scanning capabilities, identifying where automation provides the highest return and where manual processes remain necessary.

The 2022 Restructuring: What Changed

The 2022 revision consolidated the previous 114 controls (from 14 domains) into 93 controls across four themes. For automation purposes, the most significant change was the introduction of 11 new controls, several of which are directly addressable through technical scanning:

• A.8.9 Configuration management: Explicitly requires that configurations of hardware, software, services, and networks are established, documented, implemented, monitored, and reviewed. This control is essentially the CIS Benchmark use case stated in ISO language.
• A.8.16 Monitoring activities: Requires monitoring of networks, systems, and applications for anomalous behavior.
• A.8.23 Web filtering: Requires management of access to external websites to reduce exposure to malicious content.
• A.8.28 Secure coding: Requires secure coding principles to be applied in software development.

Mapping CIS Benchmark Controls to Annex A

The following mapping identifies Annex A controls where CIS Benchmark scanning provides direct evidence of implementation and effectiveness. This is not theoretical -- these are controls where automated scan results can serve as audit evidence.

#### A.5.15 -- Access Control

CIS Coverage: High

CIS Benchmarks include extensive controls for access management:

• Password policies (length, complexity, history, age)
• Account lockout configurations
• Privilege assignment (User Rights Assignments in Windows, sudoers in Linux)
• Default account management (disabling or renaming built-in Administrator/root accounts)
• Session timeout and inactivity locks

Automated scanning can verify that access control technical policies are implemented correctly across every system in scope.

#### A.5.17 -- Authentication Information

CIS Coverage: High

Authentication controls in CIS Benchmarks address:

• Password storage mechanisms (LM hash disabling, credential caching limits)
• Multi-factor authentication configuration (where technically enforced)
• SSH key management (permitted authentication methods, key file permissions)
• NTLM version enforcement
• WDigest credential storage prevention

#### A.8.2 -- Privileged Access Rights

CIS Coverage: Medium-High

CIS Benchmarks evaluate:

• Membership in privileged groups (Administrators, Domain Admins)
• Sudo configuration and restrictions
• UAC settings and elevation behavior
• Service account privilege restrictions
• Remote access restrictions for privileged accounts

#### A.8.5 -- Secure Authentication

CIS Coverage: High

CIS controls directly address authentication security:

• TLS/SSL protocol version enforcement
• Cipher suite configuration
• Certificate validation settings
• Kerberos configuration (for Windows environments)
• SSH protocol version and algorithm enforcement

#### A.8.9 -- Configuration Management (New in 2022)

CIS Coverage: Very High

This is the most directly aligned control. CIS Benchmark scanning is configuration management assessment. Every scan:

• Evaluates the current configuration against an approved baseline
• Identifies deviations (configuration drift)
• Produces timestamped evidence of the configuration state
• Enables trend analysis over time

Organizations using continuous CIS scanning can demonstrate to auditors that configuration management is not just documented but actively enforced and monitored.

#### A.8.10 -- Information Deletion

CIS Coverage: Medium

CIS Benchmarks address secure data handling through:

• Temporary file management
• Pagefile and swap space clearing
• Memory dump configuration
• Recycle Bin policies

#### A.8.12 -- Data Leakage Prevention

CIS Coverage: Low-Medium

CIS controls that contribute to DLP:

• USB and removable media restrictions
• Network share permissions
• Clipboard redirection settings in RDP
• Print driver restrictions

#### A.8.15 -- Logging

CIS Coverage: Very High

Logging is one of the most extensively covered areas in CIS Benchmarks:

• Windows Audit Policy configuration (17+ subcategories)
• Linux auditd rules (file access, privilege use, authentication events)
• Log file permissions and retention
• Remote log forwarding configuration (syslog/rsyslog)
• Event log size and rotation settings

Automated scanning verifies that every system in scope has the required logging configuration, providing auditors with concrete evidence.

#### A.8.16 -- Monitoring Activities (New in 2022)

CIS Coverage: Medium

CIS Benchmarks contribute to monitoring through:

• Audit policy configuration that generates the events needed for monitoring
• Log forwarding to centralized systems (SIEM)
• System integrity monitoring configurations

The monitoring infrastructure is validated by CIS scanning; the monitoring analysis requires additional tooling (SIEM, SOAR).

#### A.8.20 -- Networks Security

CIS Coverage: High

CIS Benchmarks address network security through:

• Host-based firewall configuration (Windows Firewall, iptables/nftables)
• IP forwarding and routing restrictions
• Network protocol restrictions (disabling IPv6 if unused, disabling LLMNR)
• Wireless configuration security
• SNMP version and community string configuration

#### A.8.21 -- Security of Network Services

CIS Coverage: Medium-High

Relevant CIS controls:

• TLS configuration for web servers (IIS, Apache, nginx)
• SSH hardening (permitted algorithms, protocol versions)
• DNS security settings
• RDP security configuration (NLA, encryption level)

#### A.8.22 -- Segregation of Networks

CIS Coverage: Medium

CIS host-level controls that support network segregation:

• Host-based firewall zone configuration
• IP forwarding restrictions
• VLAN-related configurations on network devices (via CIS network device benchmarks)

#### A.8.26 -- Application Security Requirements

CIS Coverage: Medium

CIS Benchmarks for application platforms (IIS, Apache, PostgreSQL, MySQL, Oracle) address:

• Default account removal
• Unnecessary module/feature disabling
• Request size limits and timeout configurations
• Error handling (preventing information disclosure)
• Directory listing restrictions

Controls That Cannot Be Automated Through CIS Scanning

It is equally important to understand where CIS scanning does not provide coverage. The following Annex A controls require manual processes, organizational policies, or different tools:

Organizational Controls (A.5.x):

• A.5.1 Policies for information security (requires documented policies)
• A.5.2 Information security roles and responsibilities (organizational structure)
• A.5.4 Management responsibilities (management commitment)
• A.5.5 Contact with authorities (process documentation)

People Controls (A.6.x):

• A.6.1 Screening (background checks -- HR process)
• A.6.2 Terms and conditions of employment (legal/HR)
• A.6.3 Information security awareness, education and training (training programs)
• A.6.7 Remote working (policy-based)

Physical Controls (A.7.x):

• All 14 physical controls (A.7.1 through A.7.14) require physical inspection, not technical scanning

Building an Evidence Matrix

For ISO 27001 certification audits, mapping your evidence sources to Annex A controls is essential. A practical evidence matrix for the technological controls looks like this:

Quantifying the Automation Opportunity

Of the 93 Annex A controls in ISO 27001:2022:

• 34 are technological controls (the A.8.x category)
• ~22 of these 34 have direct or significant CIS Benchmark scanning coverage
• That means approximately 65% of technological controls can be partially or fully evidenced through CIS Benchmark compliance scanning
• Across all 93 controls, CIS scanning contributes evidence for roughly 24% of the total framework

This may seem modest, but the technological controls are the most labor-intensive to evidence manually. They require checking configurations across every in-scope system -- potentially hundreds or thousands of machines. Automating this evidence collection eliminates hundreds of hours of manual audit preparation.

Practical Recommendations

1. Start with A.8.9 (Configuration Management)

This control is the foundation. Implement continuous CIS Benchmark scanning first, then use the results as evidence for multiple other controls.

2. Align Your Statement of Applicability (SoA)

Map each applicable Annex A control to its evidence source. For controls covered by CIS scanning, document the scan tool, frequency, and baseline used.

3. Automate Evidence Collection

Ensure your scanning solution generates reports in formats that auditors can consume. PDF reports with timestamps, system identifiers, and pass/fail results for each control are the minimum.

4. Address Gaps with Compensating Controls

For Annex A controls not covered by CIS scanning, implement appropriate manual or organizational controls and document them separately.

CISGuard maps its 3,928 CIS Benchmark controls directly to ISO 27001:2022 Annex A, providing automated evidence collection for the technological controls that consume the most audit preparation time. With continuous scanning and compliance dashboards, your ISMS can demonstrate ongoing effectiveness -- not just point-in-time compliance -- to certification auditors.