8 of 93 ISO 27001 controls cover people; people are in 62% of breaches
ISO 27001's people controls against Verizon's 2026 breach data: what a compliance platform like Sprinto can evidence and what it cannot, as of September 2026.
A compliance platform can prove that your people controls exist; it cannot prove that your people behave. ISO/IEC 27001:2022 has 93 Annex A controls, and 8 of them are about people.1 Verizon’s 2026 Data Breach Investigations Report found a human element in 62% of breaches, up from 60% a year earlier.2 The 2024 version of this piece argued that a compliance tool such as Sprinto could turn audit work into a security culture. The fair question underneath it is whether buying compliance automation is the same as running a security programme. It is not, and the gap is measurable.
01Where the people controls sit in ISO 27001
People get 8 of ISO 27001's 93 controls; organisational and technical controls take 71
Number of Annex A controls by theme, ISO/IEC 27001:2022
- People (6.1 to 6.8), screening to event reporting8 controls 9%
- Organisational (5.1 to 5.37)37 controls 40%
- Technological (8.1 to 8.34)34 controls 37%
- Physical (7.1 to 7.14)14 controls 15%
Table view
| Value (controls) | Share | |
|---|---|---|
| People (6.1 to 6.8), screening to event reporting | 8 | 9% |
| Organisational (5.1 to 5.37) | 37 | 40% |
| Technological (8.1 to 8.34) | 34 | 37% |
| Physical (7.1 to 7.14) | 14 | 15% |
Source: ISO/IEC 27001:2022 Annex A, as listed by ISMS.online · as of the 2022 edition
The 2022 revision cut the list from 114 controls in 14 categories to 93 in four themes, 11 of them new.1 The eight people controls are screening, terms of employment, awareness and training, the disciplinary process, duties after leaving, confidentiality agreements, remote working and security event reporting.
02What the platform evidences, and what the breach data asks for
Compliance-automation platforms, Sprinto and Scrut from India and Vanta and Drata from abroad, are built to collect evidence, map it to controls and monitor that the evidence stays current.3 For control 6.3 the evidence is a completion record and a signed policy. That is what an auditor samples, and it is worth automating. It says nothing about whether the person who completed the module would report a convincing phone call.
The 2026 DBIR shows where the calls come from. Phishing was the initial access in 16% of breaches, pretexting in 6%, and pretexting is now a common route into ransomware and extortion. In phishing simulations, the median click rate on mobile-centric vectors, voice and text messages, was 40% higher than on email.2 An annual module with an email quiz satisfies the auditor and trains for the channel that now works less well for attackers than the phone in the employee’s pocket.
03Buying in India
Sprinto’s pricing page could not be read for this piece, so no price is quoted; the global platforms list in US dollars, and a reseller invoices in rupees with 18% GST added. The regulations that bite are clocks that start with a person noticing something. The CERT-In Directions of 28 April 2022 require a reportable incident to reach CERT-In within six hours and logs to be kept for 180 days.4 The DPDP Rules, notified on 13 November 2025, bring security safeguards and breach intimation into force on 13 May 2027.5 For SEBI-regulated entities the CSCRF has applied since 31 August 2025.6 None of the three can be met by a policy acceptance record alone. TechBag’s Mitigata Compliance & GRC page compares connected and standalone GRC platforms, Sprinto included.
Sources
- ISMS.online, ISO 27001:2022 Annex A controls explained (93 controls in four themes; 114 in the 2013 edition; 11 new) — page undated; standard published 2022
- Verizon, 2026 Data Breach Investigations Report, Executive Summary (human element 62%; phishing 16%; pretexting 6%; mobile-centric click rate 40% higher), pp. 9 to 11 — 2026 edition; dataset October 2024 to November 2025
- TechBag, Mitigata Compliance & GRC intel page (Sprinto, Scrut, Vanta, Drata compared) — version committed 30 September 2026
- CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting; 180-day logs) — 28 April 2022
- MeitY, Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (notified 13 November 2025; substantive duties from 13 May 2027) — 13 November 2025
- SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities — 20 August 2024; in force 31 August 2025
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
