Skip to content
AUSEC
Esc
  • Home/
  • Services/services/
  • Penetration testing/services/penetration-testing/
  • Vulnerability assessment/services/vulnerability-assessment/
  • Security audit/services/security-audit/
  • Compliance consulting/services/compliance-consulting/
  • Incident response and digital forensics/services/digital-forensics/
  • Corporate training and workshops/services/corporate-training/
  • Audit methodology/methodology/
  • Security posture quiz/#quiz
  • Threat Lab: attack simulator/threat-lab/#simulator
  • Threat Lab: cyber kill chain/threat-lab/#kill-chain
  • Threat Lab: defence in depth/threat-lab/#defence
  • Threat Lab: spot the phish/threat-lab/#phish
  • Threat Lab: terminal/threat-lab/#terminal
  • Frameworks hub/frameworks/
  • Framework cross-mapping/frameworks/#crossmap
  • PCI DSS v4.0.1/frameworks/pci-dss/
  • ISO/IEC 27001:2022/frameworks/iso-27001/
  • ISO/IEC 27002:2022/frameworks/iso-27002/
  • NIST Cybersecurity Framework 2.0/frameworks/nist-csf/
  • CERT-In Audit Guidelines (India)/frameworks/cert-in/
  • Training and internships/training/
  • Resources: articles and checklists/resources/
  • PCI DSS v4.0.1: what changed, and what it means now/resources/pci-dss-4-0-1-changes/
  • ISO/IEC 27001:2022 Annex A for beginners/resources/iso-27001-annex-a-beginners/
  • NIST CSF 2.0: the Govern function explained/resources/nist-csf-govern-function/
  • How to prepare for a CERT-In audit/resources/prepare-cert-in-audit/
  • Glossary/resources/#glossary
  • Team and certifications/team/
  • About Ausec/about/
  • Contact and book an assessment/contact/
  • Privacy policy/privacy/
  • Terms of use/terms/
  • Responsible disclosure/responsible-disclosure/
  • Design system/styleguide/

ISO/IEC 27002:2022

Implementation guidance for the 93 information security controls.

Controls
93
Themes
4
Attribute types
5
Certifiable
No

What is ISO/IEC 27002:2022?

ISO/IEC 27002 is the code of practice that gives implementation guidance for the controls listed in ISO/IEC 27001 Annex A. Each control has a purpose, attributes and implementation guidance.

It is not certifiable by itself. Organisations use it to design and implement the controls they select in their ISO/IEC 27001 Statement of Applicability.

Who needs it

  • Teams implementing ISO/IEC 27001 Annex A controls
  • Security architects designing control sets for a specific risk profile
  • Auditors and risk managers who need a common control vocabulary
  • Organisations mapping controls to other frameworks such as NIST CSF 2.0

Themes and attributes

The 2022 edition replaced 114 controls in 14 domains with 93 controls in 4 themes, and added attributes for filtering.

Four themes

  • Organizational (37)
  • People (8)
  • Physical (14)
  • Technological (34)

Five attribute types

  • Control type: preventive, detective, corrective
  • Information security properties: confidentiality, integrity, availability
  • Cybersecurity concepts: identify, protect, detect, respond, recover
  • Operational capabilities, such as asset management or identity and access management
  • Security domains: governance and ecosystem, protection, defence, resilience

Browse all 93 controls

Search by name or number and filter by theme, control type or cybersecurity concept.

93 of 93 controls

  • 5.1Policies for information securityOrganizationalPreventive
  • 5.2Information security roles and responsibilitiesOrganizationalPreventive
  • 5.3Segregation of dutiesOrganizationalPreventive
  • 5.4Management responsibilitiesOrganizationalPreventive
  • 5.5Contact with authoritiesOrganizationalPreventiveCorrective
  • 5.6Contact with special interest groupsOrganizationalPreventiveCorrective
  • 5.7Threat intelligenceOrganizationalPreventiveDetectiveCorrectiveNew
  • 5.8Information security in project managementOrganizationalPreventive
  • 5.9Inventory of information and other associated assetsOrganizationalPreventive
  • 5.10Acceptable use of information and other associated assetsOrganizationalPreventive
  • 5.11Return of assetsOrganizationalPreventive
  • 5.12Classification of informationOrganizationalPreventive
  • 5.13Labelling of informationOrganizationalPreventive
  • 5.14Information transferOrganizationalPreventive
  • 5.15Access controlOrganizationalPreventive
  • 5.16Identity managementOrganizationalPreventive
  • 5.17Authentication informationOrganizationalPreventive
  • 5.18Access rightsOrganizationalPreventive
  • 5.19Information security in supplier relationshipsOrganizationalPreventive
  • 5.20Addressing information security within supplier agreementsOrganizationalPreventive
  • 5.21Managing information security in the ICT supply chainOrganizationalPreventive
  • 5.22Monitoring, review and change management of supplier servicesOrganizationalPreventive
  • 5.23Information security for use of cloud servicesOrganizationalPreventiveNew
  • 5.24Information security incident management planning and preparationOrganizationalCorrective
  • 5.25Assessment and decision on information security eventsOrganizationalDetective
  • 5.26Response to information security incidentsOrganizationalCorrective
  • 5.27Learning from information security incidentsOrganizationalPreventive
  • 5.28Collection of evidenceOrganizationalCorrective
  • 5.29Information security during disruptionOrganizationalPreventiveCorrective
  • 5.30ICT readiness for business continuityOrganizationalCorrectiveNew
  • 5.31Legal, statutory, regulatory and contractual requirementsOrganizationalPreventive
  • 5.32Intellectual property rightsOrganizationalPreventive
  • 5.33Protection of recordsOrganizationalPreventive
  • 5.34Privacy and protection of PIIOrganizationalPreventive
  • 5.35Independent review of information securityOrganizationalPreventiveCorrective
  • 5.36Compliance with policies, rules and standards for information securityOrganizationalPreventive
  • 5.37Documented operating proceduresOrganizationalPreventiveCorrective
  • 6.1ScreeningPeoplePreventive
  • 6.2Terms and conditions of employmentPeoplePreventive
  • 6.3Information security awareness, education and trainingPeoplePreventive
  • 6.4Disciplinary processPeoplePreventiveCorrective
  • 6.5Responsibilities after termination or change of employmentPeoplePreventive
  • 6.6Confidentiality or non-disclosure agreementsPeoplePreventive
  • 6.7Remote workingPeoplePreventive
  • 6.8Information security event reportingPeopleDetective
  • 7.1Physical security perimetersPhysicalPreventive
  • 7.2Physical entryPhysicalPreventive
  • 7.3Securing offices, rooms and facilitiesPhysicalPreventive
  • 7.4Physical security monitoringPhysicalPreventiveDetectiveNew
  • 7.5Protecting against physical and environmental threatsPhysicalPreventive
  • 7.6Working in secure areasPhysicalPreventive
  • 7.7Clear desk and clear screenPhysicalPreventive
  • 7.8Equipment siting and protectionPhysicalPreventive
  • 7.9Security of assets off-premisesPhysicalPreventive
  • 7.10Storage mediaPhysicalPreventive
  • 7.11Supporting utilitiesPhysicalPreventiveDetective
  • 7.12Cabling securityPhysicalPreventive
  • 7.13Equipment maintenancePhysicalPreventive
  • 7.14Secure disposal or re-use of equipmentPhysicalPreventive
  • 8.1User endpoint devicesTechnologicalPreventive
  • 8.2Privileged access rightsTechnologicalPreventive
  • 8.3Information access restrictionTechnologicalPreventive
  • 8.4Access to source codeTechnologicalPreventive
  • 8.5Secure authenticationTechnologicalPreventive
  • 8.6Capacity managementTechnologicalPreventiveDetective
  • 8.7Protection against malwareTechnologicalPreventiveDetectiveCorrective
  • 8.8Management of technical vulnerabilitiesTechnologicalPreventive
  • 8.9Configuration managementTechnologicalPreventiveNew
  • 8.10Information deletionTechnologicalPreventiveNew
  • 8.11Data maskingTechnologicalPreventiveNew
  • 8.12Data leakage preventionTechnologicalPreventiveDetectiveNew
  • 8.13Information backupTechnologicalCorrective
  • 8.14Redundancy of information processing facilitiesTechnologicalPreventive
  • 8.15LoggingTechnologicalDetective
  • 8.16Monitoring activitiesTechnologicalDetectiveCorrectiveNew
  • 8.17Clock synchronizationTechnologicalDetective
  • 8.18Use of privileged utility programsTechnologicalPreventive
  • 8.19Installation of software on operational systemsTechnologicalPreventive
  • 8.20Networks securityTechnologicalPreventiveDetective
  • 8.21Security of network servicesTechnologicalPreventive
  • 8.22Segregation of networksTechnologicalPreventive
  • 8.23Web filteringTechnologicalPreventiveNew
  • 8.24Use of cryptographyTechnologicalPreventive
  • 8.25Secure development life cycleTechnologicalPreventive
  • 8.26Application security requirementsTechnologicalPreventive
  • 8.27Secure system architecture and engineering principlesTechnologicalPreventive
  • 8.28Secure codingTechnologicalPreventiveNew
  • 8.29Security testing in development and acceptanceTechnologicalPreventive
  • 8.30Outsourced developmentTechnologicalPreventiveDetective
  • 8.31Separation of development, test and production environmentsTechnologicalPreventive
  • 8.32Change managementTechnologicalPreventive
  • 8.33Test informationTechnologicalPreventive
  • 8.34Protection of information systems during audit testingTechnologicalPreventive

Control titles from ISO/IEC 27002:2022. Attribute tags are indicative; refer to the standard for the authoritative attribute table.

How it is used in practice

ISO/IEC 27002 is guidance, so there is no certification audit. It shapes how controls are designed and evidenced.

  1. 01

    Select

    Choose controls through your ISO/IEC 27001 risk assessment and record them in the Statement of Applicability.

  2. 02

    Design

    Use the 27002 purpose and guidance to design each control for your environment.

  3. 03

    Implement and evidence

    Put controls into operation and keep the records an auditor will ask for.

  4. 04

    Review

    Use attributes to check coverage, for example whether you have enough detective controls.

From gap to evidence

  • Control design workshops using the 27002 guidance
  • Attribute-based coverage reviews to find blind spots
  • Mapping 27002 controls to PCI DSS and NIST CSF 2.0 so one control set serves several obligations
  • Evidence packs that hold up in an ISO/IEC 27001 audit

Frequently asked questions

Can we get certified to ISO/IEC 27002?

No. Certification is against ISO/IEC 27001. ISO/IEC 27002 provides the guidance for implementing its controls.

How does ISO/IEC 27002 relate to ISO/IEC 27001 Annex A?

Annex A lists the same 93 control titles. ISO/IEC 27002 adds the purpose, attributes and implementation guidance for each one.

What changed from the 2013 edition?

114 controls in 14 domains became 93 controls in 4 themes. Many controls were merged, 11 were added, and attributes were introduced.

What are attributes for?

They let you filter and view controls from different angles, such as control type or cybersecurity concept, to check coverage or map to other frameworks.

Working towards ISO 27002?

Start with a gap assessment and a clear, prioritised plan.

Book a gap assessment