Which Are The Four Major Areas Covered By The Standard

You're staring at a compliance checklist, a certification audit looming, or maybe just a job description that casually drops "must understand the four major areas of the standard." And you're thinking: *Which standard? There are hundreds.

Yeah. That's the problem.

People say "the standard" like there's only one. In quality, it's ISO 9001. In privacy, maybe GDPR or NIST. In service management, it's ITIL. In infosec, it's usually ISO 27001. Each has its own structure, its own "major areas," and none of them agree on the number four.

So let's clear the air. Below is a straight-talk guide to the frameworks people actually mean when they say "the four major areas" — what they are, why they exist, and how to tell which one you're dealing with.

What People Usually Mean by "The Standard"

Context is everything. Here's the short version:

| If you're in... | "The Standard" probably means... | Does it have 4 major areas?

If you're prepping for an ISO 27001 audit or an ITIL 4 exam, you're in the right place. Plus, those two actually have four major areas. Most others don't.

Let's break both down — because odds are, one of them is why you're here.

ISO 27001:2022 — The Four Control Themes

ISO 27001 didn't always have four themes. Which means the 2013 version had 14 control domains (A. 5–A.18). The 2022 update collapsed them into four thematic groups — not because the controls changed that much, but to make them easier to deal with, map, and explain to non-technical stakeholders.

1. Organizational Controls (Clause A.5)

This is the "governance" layer. Policies, roles, responsibilities, and the rules of the road.

What lives here:

• Information security policies (A.5.1)
• Roles and responsibilities (A.5.2)
• Segregation of duties (A.5.3)
• Contact with authorities and special interest groups (A.5.4–5.5)
• Threat intelligence (A.5.7)
• Information security in project management (A.5.8)

Why it matters: If this layer is weak, the rest is theater. You can have the best firewall on earth — but if nobody owns the policy, nobody updates it, and nobody reads it, it's useless.

2. People Controls (Clause A.6)

Human risk. The squishy, unpredictable, absolutely critical layer.

What lives here:

• Screening (A.6.1)
• Terms and conditions of employment (A.6.2)
• Awareness and training (A.6.3)
• Disciplinary process (A.6.4)
• Responsibilities after termination (A.6.5)
• Confidentiality agreements (A.6.6)
• Remote work (A.6.7)

Real talk: This is where most audits find gaps. Not because companies don't care — because they treat onboarding/offboarding as HR admin, not security controls. They're both.

3. Physical Controls (Clause A.7)

Doors. That's why locks. Badges. Cameras. Environmental protection. The stuff you can kick.

What lives here:

• Physical security perimeters (A.7.1)
• Physical entry controls (A.7.2)
• Securing offices, rooms, facilities (A.7.3)
• Physical security monitoring (A.7.4)
• Protecting against environmental threats (A.7.5)
• Working in secure areas (A.7.6)
• Clear desk / clear screen (A.7.7)
• Equipment siting and protection (A.7.8–7.10)
• Utilities and cabling (A.7.11–7.13)

Don't skip this. A stolen laptop from an unmonitored lobby beats a zero-day exploit every time. Physical security is infosec.

4. Technological Controls (Clause A.8)

The one everyone thinks is the whole standard. Firewalls, encryption, MFA, logging, vulnerability management, secure development.

What lives here:

Continue exploring with our guides on what are the most common bloodborne pathogens and what are the osha construction standards also called.

• User endpoint protection (A.8.1)
• Privileged access rights (A.8.2)
• Information access restriction (A.

4. Technological Controls (Clause A.8)

The one everyone thinks is the whole standard. Firewalls, encryption, MFA, logging, vulnerability management, secure development.

What lives here:

• User endpoint protection (A.8.1)
• Privileged access rights (A.8.2)
• Information access restriction (A.8.3)
• Information deletion (A.8.4)
• Logging and monitoring activities (A.8.5)
• Secure system engineering principles (A.8.6)
• Secure development lifecycle (A.8.7)
• Secure system architecture (A.8.8)
• Security testing (A.8.9)
• Secure system configuration (A.8.10)
• Network security controls (A.8.11)
• Security of network services (A.8.12)
• Vulnerability management (A.8.13)
• Patch management (A.8.14)
• Malware protection (A.8.15)
• Backup management (A.8.16)
• Redundancy and resilience (A.8.17)
• Information processing facilities (A.8.18)

Don't get lost in the tech. These controls are the tools of the trade, but they’re only as good as the governance, people, and physical layers supporting them. A misconfigured firewall or unpatched system isn’t just a technical failure — it’s a symptom of deeper organizational or procedural issues.

Conclusion

ISO 27001:2022’s four themes aren’t just a reorganization — they’re a reminder that information security is a system, not a checklist. Organizational controls set the foundation; people controls address the human element; physical controls secure the tangible; and

technological controls deliver the tools to operationalize security. On top of that, together, they form a cohesive framework that recognizes the interconnectedness of people, processes, technology, and environment. ISO 27001 doesn’t just protect data—it protects the entire ecosystem that sustains it.

Conclusion
ISO 27001:2022’s four themes—Organizational Controls, People Controls, Physical Controls, and Technological Controls—are not isolated components but interdependent pillars of a resilient information security management system (ISMS). By addressing governance, human behavior, physical infrastructure, and technological safeguards holistically, the standard ensures that security is woven into the fabric of an organization’s operations.

Organizational controls establish accountability and strategic alignment, ensuring that information security is a business priority. People controls mitigate the risks posed by human error and intentional misconduct, fostering a culture of vigilance. Physical controls safeguard against tangible threats, from unauthorized access to environmental hazards, while technological controls provide the technical defenses against evolving cyber threats.

Critically, the standard rejects siloed thinking. A breach caused by a misconfigured firewall (technological) may stem from inadequate patch management (organizational) or a lack of employee training (people). Similarly, a stolen device (physical) can compromise encrypted data (technological) if access controls (people/organizational) are lax. ISO 27001’s strength lies in its insistence that no single layer operates in isolation.

Implementing the standard requires more than compliance—it demands a mindset shift. So organizations must view security as a continuous process, not a one-time checklist. This means investing in employee awareness, refining processes like incident response, and regularly auditing controls across all four themes. By doing so, businesses can build an ISMS that adapts to emerging risks while protecting the confidentiality, integrity, and availability of their information assets.

In an era where cyber threats grow more sophisticated and physical risks persist, ISO 27001:2022 offers a roadmap for creating security that is as dynamic and interconnected as the modern enterprise itself. The result is not just compliance, but resilience—a foundation for trust in an increasingly digital world.

Building on the foundational pillars described earlier, organizations that fully integrate ISO 27001:2022 see measurable improvements in risk visibility, incident response speed, and stakeholder confidence. The standard’s emphasis on continuous monitoring and periodic review cultivates a culture where security is not an afterthought but a core business driver, enabling companies to align information protection with strategic objectives and market demands. Beyond that, the systematic approach to auditing and improvement creates a feedback loop that drives operational excellence, reduces the financial impact of breaches, and supports compliance with evolving legal and regulatory requirements.

Simply put, ISO 27001:2022 provides a comprehensive, adaptable framework that unifies people, processes, technology, and physical safeguards into a resilient security ecosystem, positioning organizations to thrive in an increasingly complex threat landscape.