By Jackson Godwin | Cybersecurity Analyst & Penetration Tester. info@jacksontechnology.com.ng

Published: June 2026.

As organizations accelerate their migration to Amazon Web Services (AWS), ensuring that cloud environments meet internationally recognized security standards has become a top priority for security teams, compliance officers, and CISOs alike. ISO 27001:2022 — the global benchmark for Information Security Management Systems (ISMS) — was significantly updated in 2022 to reflect modern threat landscapes, including those unique to cloud infrastructure.

This article provides a practical, actionable guide on how to map ISO 27001:2022 Annex A controls to AWS cloud services, enabling your organization to achieve and maintain compliance while leveraging the full power of the AWS ecosystem. Whether you are preparing for a certification audit, conducting a cloud security gap assessment, or building a cloud-native ISMS, this mapping will serve as your technical reference.

Whether you are preparing for an ISO 27001:2022 certification audit, conducting a cloud security gap assessment, or building a cloud-native ISMS, this mapping will serve as your technical reference guide.

1. Understanding ISO 27001:2022 Annex A — What Changed?

ISO 27001:2022 restructured Annex A from 114 controls across 14 domains to 93 controls across just 4 themes. This consolidation introduced 11 brand-new controls specifically designed to address cloud computing, threat intelligence, data masking, web filtering, and secure coding practices — making the 2022 revision far more relevant to organizations operating in cloud environments.

The Four Annex A Themes in ISO 27001:2022:

• A.5 — Organizational Controls (37 controls)
• A.6 — People Controls (8 controls)
• A.7 — Physical Controls (14 controls)
• A.8 — Technological Controls (34 controls)

For cloud-first organizations running workloads on AWS, the majority of relevant controls fall under A.8 (Technological Controls), though governance controls in A.5 — particularly around access control, identity management, and information security policies — are equally critical. The good news is that AWS offers native services that map directly to nearly all of these requirements, making compliance achievable without extensive third-party tooling.

2. Why AWS Is Well-Positioned for ISO 27001:2022 Compliance

AWS operates under a Shared Responsibility Model, which defines a clear division between the security of the cloud (AWS's responsibility) and security in the cloud (the customer's responsibility). Understanding this model is the essential first step in any ISO 27001 cloud mapping exercise.

AWS's Responsibility (Security OF the Cloud):

• Physical security of data centers — satisfies A.7 Physical Controls
• Hardware, software, networking, and facility infrastructure management
• Hypervisor and virtualization layer security and integrity

Customer's Responsibility (Security IN the Cloud):

• Identity and access management (IAM) configurations and governance
• Encryption of data at rest and in transit across all services
• Network security architecture — VPCs, Security Groups, NACLs, WAF
• Logging, monitoring, detection, and incident response capabilities
• Patch management for operating systems and customer-installed applications

AWS holds its own ISO 27001 certification, which means AWS infrastructure already satisfies many physical and operational controls. Your certification scope therefore focuses on how YOU configure and operate AWS services — not the underlying infrastructure.

3. ISO 27001:2022 Annex A to AWS Services — Mapping Table

The following table provides a direct mapping between the most critical ISO 27001:2022 Annex A controls and the corresponding AWS native services that satisfy each requirement. This table is structured to be used directly in your Statement of Applicability (SoA) and audit evidence packages.

Annex A Control	AWS Service(s)	How It Satisfies the Control
A.5 – Organizational Controls	IAM Policies & SCPs	AWS IAM and Organizations enforce least privilege, SCP boundaries, and policy governance across all accounts
A.6 – People Controls	IAM Identity Center	Centralize human identity management, enforce MFA, and manage SSO access across AWS accounts
A.7 – Physical Controls	AWS Shared Responsibility	AWS manages physical data center security; customers secure logical access and configuration layers
A.8.2 – Privileged Access Rights	AWS IAM + CloudTrail	Restrict privileged roles, enforce MFA for root and admin accounts, log all API calls via CloudTrail
A.8.3 – Information Access Restriction	S3 Bucket Policies + KMS	Enforce bucket-level access controls; encrypt data at rest using KMS customer-managed keys
A.8.7 – Protection Against Malware	Amazon GuardDuty	Continuous threat detection; identifies malware activity, crypto-mining, and compromised credentials
A.8.8 – Vulnerability Management	Amazon Inspector	Automated CVE scanning for EC2 instances, container images (ECR), and Lambda functions
A.8.9 – Configuration Management	AWS Config	Track resource configurations over time, enforce compliance rules, and detect configuration drift
A.8.11 – Data Masking	Amazon Macie + Redshift	Identify and protect sensitive data (PII/PCI); apply dynamic data masking in Redshift
A.8.12 – Data Leakage Prevention	AWS Macie + VPC Endpoints	Monitor data movement; restrict internet egress via VPC endpoints, NACLs, and GuardDuty alerts
A.8.15 – Logging	CloudTrail + CloudWatch	Capture all API activity; aggregate and retain logs; ship to SIEM via Kinesis Data Firehose
A.8.16 – Monitoring Activities	AWS Security Hub	Centralized security posture management; aggregates findings from GuardDuty, Inspector, and Config
A.8.20 – Network Security	VPC + Security Groups	Segment networks with VPCs; enforce ingress/egress rules via Security Groups and NACLs
A.8.21 – Security of Network Services	AWS WAF + Shield	Protect web apps from OWASP Top 10 attacks; mitigate DDoS via AWS Shield Advanced
A.8.24 – Use of Cryptography	AWS KMS + ACM	Manage encryption keys with KMS; provision and rotate TLS/SSL certificates via ACM
A.8.25 – Secure Development	CodePipeline + SAST Tools	Integrate security scanning into CI/CD pipelines; enforce SAST/DAST gate checks before deployments
A.8.32 – Change Management	CloudFormation + Config	Infrastructure-as-Code version control; Config rules detect and alert on unauthorized changes

4. Deep Dive: Key Control Mappings You Must Get Right

A.8.2 — Privileged Access Rights (AWS IAM + CloudTrail)

Privileged access management is one of the highest-risk areas in any cloud environment. ISO 27001:2022 A.8.2 requires organizations to restrict, monitor, and periodically review all privileged access rights. On AWS, this is implemented through a combination of controls:

• Creating IAM roles with least-privilege policies — avoid long-term access keys wherever possible
• Enforcing Multi-Factor Authentication (MFA) on root accounts and all privileged IAM users
• Using AWS CloudTrail to capture every API call, including privileged actions, across all regions and accounts
• Deploying AWS IAM Access Analyzer to automatically identify overly permissive cross-account policies
• Rotating and managing credentials securely using AWS Secrets Manager with automated rotation

A.8.8 — Management of Technical Vulnerabilities (Amazon Inspector)

Vulnerability management is a core requirement under ISO 27001:2022. Control A.8.8 mandates the timely identification, evaluation, and remediation of technical vulnerabilities in information systems. Amazon Inspector provides automated, continuous scanning of:

• EC2 instances for operating system CVEs and network reachability exposure
• Amazon ECR container images for package-level vulnerabilities before deployment to production
• AWS Lambda functions for software dependency vulnerabilities in function code and layers

Inspector integrates natively with AWS Security Hub, enabling centralized vulnerability findings with CVSS v3 severity scoring — directly supporting your ISMS risk register and risk treatment plan.

A.8.15 — Logging (CloudTrail + CloudWatch + S3)

ISO 27001:2022 A.8.15 requires that security-relevant events are logged, that logs are protected against tampering, and that they are available for review and investigation. Your AWS logging architecture must include:

• AWS CloudTrail enabled across all regions with log file integrity validation enabled
• CloudTrail logs stored in an immutable, separate AWS account S3 bucket with S3 Object Lock (WORM) enabled
• CloudWatch Logs for application-level event logging with defined retention periods
• VPC Flow Logs for full network traffic analysis and anomaly detection
• AWS Security Hub aggregating findings from GuardDuty, Config, Inspector, Macie, and Firewall Manager
• Amazon Kinesis Data Firehose for real-time log streaming to your SIEM platform

A.8.24 — Use of Cryptography (AWS KMS + ACM)

Control A.8.24 requires a formal cryptographic policy covering algorithm selection, key management, and key lifecycle. AWS Key Management Service (KMS) provides a FIPS 140-2 validated cryptographic foundation that includes:

• Centralized management of symmetric and asymmetric encryption keys with automatic annual rotation
• Customer Managed Keys (CMKs) for granular key policy control and per-service encryption
• Envelope encryption for S3, RDS, EBS, DynamoDB, and virtually all AWS storage services
• Full CloudTrail logging of all key usage, providing a complete cryptographic audit trail

For data in transit, AWS Certificate Manager (ACM) provisions and manages TLS/SSL certificates for CloudFront distributions, Application Load Balancers, and API Gateway — satisfying transport layer encryption requirements at no additional cost for certificates used within AWS.

5. Building Your ISO 27001 Statement of Applicability (SoA) for AWS

The Statement of Applicability (SoA) is a mandatory ISO 27001 deliverable that lists all Annex A controls, declares whether each is applicable to your ISMS scope, and documents how it is implemented or justifies its exclusion. For AWS environments, a well-structured SoA should:

• Reference specific AWS services, resource ARNs, and account IDs as implementation evidence for each applicable control
• Document the Shared Responsibility Model boundary to justify exclusion of physical controls (A.7) where AWS manages the facility
• Include AWS Config rule compliance reports, CloudTrail excerpts, and Security Hub findings as supporting audit artifacts
• Reference AWS's own ISO 27001 certification (downloadable from AWS Artifact) to cover infrastructure-level controls within your SoA
• Map control implementations to specific AWS accounts, regions, and organizational units for audit precision

Pro Tip: Use AWS Audit Manager with the pre-built ISO/IEC 27001 framework template to automatically collect evidence from your AWS environment. It maps AWS Config rules and CloudTrail events directly to Annex A control requirements — dramatically reducing manual audit preparation effort.

6. Practical Steps to Achieve ISO 27001:2022 Compliance on AWS

A structured implementation approach ensures your team closes security gaps efficiently and builds an auditable compliance posture. Follow these steps in sequence:

Step 1 — Define and Scope Your AWS Environment

Determine which AWS accounts, regions, services, and data types fall within your ISMS scope. Use AWS Organizations and Service Control Policies (SCPs) to enforce security baselines from a central management account, ensuring no in-scope account can deviate from your minimum security requirements.

Step 2 — Conduct a Cloud Security Gap Assessment

Enable AWS Security Hub with the AWS Foundational Security Best Practices (FSBP) and CIS AWS Benchmarks standards. Cross-reference Security Hub findings against the ISO 27001:2022 Annex A mapping table above to identify gaps in control coverage. Supplement automated findings with a professional penetration test of your internet-facing AWS attack surface to uncover business logic and configuration vulnerabilities that automated tools miss.

Step 3 — Implement Controls Using Infrastructure as Code

Deploy all security controls using AWS CloudFormation or Terraform templates stored in a version-controlled repository. This satisfies A.8.32 (Change Management) by ensuring every infrastructure change is documented, peer-reviewed, and approved before deployment — creating a complete change audit trail for auditors.

Step 4 — Enable Continuous Compliance Monitoring

Deploy AWS Config with managed rules mapped to your ISO 27001 controls. Configure automatic remediation of non-compliant resources using AWS Systems Manager Automation runbooks. Set up Security Hub to send critical compliance findings to your security team via Amazon SNS, PagerDuty, or Slack integration — ensuring no compliance drift goes undetected.

Step 5 — Test and Document Your Incident Response Capability

ISO 27001:2022 A.5.26 requires a documented and tested information security incident response process. Create AWS-specific incident response playbooks that cover GuardDuty finding triage procedures, EC2 instance isolation steps, CloudTrail forensic investigation workflows, and escalation paths. Conduct tabletop exercise simulations quarterly to validate team readiness and update playbooks accordingly.

7. Common Pitfalls to Avoid

• Leaving the AWS root account without MFA enabled — this is a critical finding in every cloud security audit and fails A.8.2 immediately
• Using long-term IAM access keys for applications and services instead of IAM roles with temporary credentials
• Disabling CloudTrail in any region or failing to protect logs with S3 Object Lock — leaving your audit trail vulnerable to tampering
• Publicly accessible S3 buckets — Amazon Macie and Config rules must flag these automatically in all environments
• Failing to document the Shared Responsibility Model boundary explicitly in your SoA, risk register, and asset inventory
• Treating AWS's own ISO 27001 compliance certifications as a complete substitute for your own customer-side control implementations
• Neglecting inter-account access risks — overly permissive cross-account IAM roles are a frequent source of lateral movement in cloud breaches

Conclusion

Mapping ISO 27001:2022 Annex A controls to AWS cloud infrastructure is not only achievable but, when done correctly, creates a layered, continuously monitored, and audit-ready security posture that satisfies both regulatory requirements and real-world threat defense objectives. The key insight is that ISO 27001 defines what must be controlled, while AWS native services define how those controls are implemented and evidenced.

By strategically leveraging AWS IAM, CloudTrail, Security Hub, GuardDuty, Inspector, Config, KMS, Macie, WAF, and Audit Manager, organizations can build a cloud-native ISMS that is scalable, cost-effective, and ready for external certification audits. The mapping table and step-by-step implementation framework in this article provide a proven technical foundation for your ISO 27001:2022 compliance journey on AWS.

If your organization requires a professional cloud security gap assessment, ISO 27001 readiness review, or penetration testing across your AWS environment, reach out for a consultation. A rigorous, evidence-based security assessment is always the most effective starting point for sustainable compliance and genuine security resilience.

About the Author

Jackson Godwin is a Cybersecurity Team Lead and Penetration Tester with over 4 years of experience delivering VAPT engagements, cloud security reviews, and ISO 27001 compliance advisory across financial institutions, fintech organizations, and government agencies. He has led 25+ security engagements across web, mobile, cloud, and network environments, and holds certifications in Ethical Hacking (CEH), ISO 27001 Information Security Foundation, and EC-Council EHE/DFE frameworks.

Contact: info@jacksontechnology.com.ng