--- title: "8 of 93 ISO 27001 controls cover people; people are in 62% of breaches" summary: "ISO 27001's people controls against Verizon's 2026 breach data: what a compliance platform like Sprinto can evidence and what it cannot, as of September 2026." url: https://www.thetechbag.com/blog/cultivating-security-as-mindset-beyond-box-checking format: Note desk: "Security operations" published: 2025-12-30 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["Sprinto","compliance automation","GRC","ISO 27001","security awareness","phishing","Verizon DBIR","CERT-In","DPDP","SEBI CSCRF"] cover: https://www.thetechbag.com/blog/covers/cultivating-security-as-mindset-beyond-box-checking.png --- # 8 of 93 ISO 27001 controls cover people; people are in 62% of breaches *ISO 27001's people controls against Verizon's 2026 breach data: what a compliance platform like Sprinto can evidence and what it cannot, as of September 2026.* Note · Security operations · By TechBag · Published 2025-12-30 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/cultivating-security-as-mindset-beyond-box-checking A compliance platform can prove that your people controls exist; it cannot prove that your people behave. ISO/IEC 27001:2022 has 93 Annex A controls, and 8 of them are about people.[1] Verizon’s 2026 Data Breach Investigations Report found a human element in 62% of breaches, up from 60% a year earlier.[2] The 2024 version of this piece argued that a compliance tool such as Sprinto could turn audit work into a security culture. The fair question underneath it is whether buying compliance automation is the same as running a security programme. It is not, and the gap is measurable. ## Where the people controls sit in ISO 27001 **Figure: People get 8 of ISO 27001's 93 controls; organisational and technical controls take 71** *Number of Annex A controls by theme, ISO/IEC 27001:2022* - People (6.1 to 6.8), screening to event reporting8 controls 9% - Organisational (5.1 to 5.37)37 controls 40% - Technological (8.1 to 8.34)34 controls 37% - Physical (7.1 to 7.14)14 controls 15% | | Value (controls) | Share | | --- | --- | --- | | People (6.1 to 6.8), screening to event reporting | 8 | 9% | | Organisational (5.1 to 5.37) | 37 | 40% | | Technological (8.1 to 8.34) | 34 | 37% | | Physical (7.1 to 7.14) | 14 | 15% | Source: ISO/IEC 27001:2022 Annex A, as listed by ISMS.online · as of the 2022 edition The 2022 revision cut the list from 114 controls in 14 categories to 93 in four themes, 11 of them new.[1] The eight people controls are screening, terms of employment, awareness and training, the disciplinary process, duties after leaving, confidentiality agreements, remote working and security event reporting. TechBag countTechBag count Of the eight, two describe what an employee does when attacked: 6.3 (awareness, education and training) and 6.8 (information security event reporting). The other six are paperwork an HR system already holds. That is 2 of 93 controls carrying the whole idea of a “security mindset”. ## What the platform evidences, and what the breach data asks for Compliance-automation platforms, Sprinto and Scrut from India and Vanta and Drata from abroad, are built to collect evidence, map it to controls and monitor that the evidence stays current.[3] For control 6.3 the evidence is a completion record and a signed policy. That is what an auditor samples, and it is worth automating. It says nothing about whether the person who completed the module would report a convincing phone call. The 2026 DBIR shows where the calls come from. Phishing was the initial access in 16% of breaches, pretexting in 6%, and pretexting is now a common route into ransomware and extortion. In phishing simulations, the median click rate on mobile-centric vectors, voice and text messages, was 40% higher than on email.[2] An annual module with an email quiz satisfies the auditor and trains for the channel that now works less well for attackers than the phone in the employee’s pocket. Our view Our view: buy compliance automation for what it does well, the audit. Then budget separately for two numbers the platform does not produce: the share of staff who report a simulated voice or text lure, and the minutes from first report to the security team. Those are controls 6.3 and 6.8 measured as behaviour rather than as paperwork. ## Buying in India Sprinto’s pricing page could not be read for this piece, so no price is quoted; the global platforms list in US dollars, and a reseller invoices in rupees with 18% GST added. The regulations that bite are clocks that start with a person noticing something. The CERT-In Directions of 28 April 2022 require a reportable incident to reach CERT-In within six hours and logs to be kept for 180 days.[4] The DPDP Rules, notified on 13 November 2025, bring security safeguards and breach intimation into force on 13 May 2027.[5] For SEBI-regulated entities the CSCRF has applied since 31 August 2025.[6] None of the three can be met by a policy acceptance record alone. TechBag’s [Mitigata Compliance & GRC page](https://www.thetechbag.com/mitigata/mitigata-compliance-grc) compares connected and standalone GRC platforms, Sprinto included. How we did this Figures as of 30 September 2026 Control counts are the ISO/IEC 27001:2022 Annex A list as reproduced by ISMS.online; the ISO text itself is paid and was not read. The “two of 93” split is TechBag’s reading of the eight people controls. Breach shares are from Verizon’s 2026 DBIR Executive Summary (dataset October 2024 to November 2025). The platform descriptions come from TechBag’s Mitigata page as committed on 30 September 2026. The 2024 post made no numerical claims; its benefit list (reduced risk, engagement, reputation) is dropped because none of it was measured. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [ISMS.online, ISO 27001:2022 Annex A controls explained (93 controls in four themes; 114 in the 2013 edition; 11 new)](https://www.isms.online/iso-27001/annex-a-2022/) — page undated; standard published 2022 2. [Verizon, 2026 Data Breach Investigations Report, Executive Summary (human element 62%; phishing 16%; pretexting 6%; mobile-centric click rate 40% higher), pp. 9 to 11](https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf) — 2026 edition; dataset October 2024 to November 2025 3. [TechBag, Mitigata Compliance & GRC intel page (Sprinto, Scrut, Vanta, Drata compared)](https://www.thetechbag.com/mitigata/mitigata-compliance-grc) — version committed 30 September 2026 4. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting; 180-day logs)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 5. [MeitY, Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (notified 13 November 2025; substantive duties from 13 May 2027)](https://www.meity.gov.in/data-protection-framework) — 13 November 2025 6. [SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities](https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html) — 20 August 2024; in force 31 August 2025 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Mitigata Compliance & GRC intel page](https://www.thetechbag.com/mitigata/mitigata-compliance-grc) — connected GRC against Sprinto, Scrut, Vanta and Drata - [Security guides](https://www.thetechbag.com/browse/security) — email security, SIEM and the controls the audit samples