ISO/IEC 27001 tells you that you must consider 93 Annex A controls, but it gives each one a single sentence; the practical detail sits in ISO/IEC 27002:2022, which many teams never open. Without it, control owners guess what "configuration management" or "monitoring activities" should mean, auditors and implementers disagree, and the Statement of Applicability becomes a list of claims. This guide goes control by control through the structure of ISO/IEC 27002:2022: the four themes and every control title, the 11 new controls, the five attribute types, how the 2013 controls map to the 2022 set, and how to implement and evidence the controls. It states control numbers, titles and structure only; the guidance text itself is copyright ISO and IEC and must be read in the standard. For certification, scoping and the audit cycle, see the ISO 27001 Certification Guide.
Key takeaways
- Same 93 controls, two documents. ISO/IEC 27001:2022 Annex A lists the controls normatively; ISO/IEC 27002:2022 gives the purpose, guidance and attributes for each. You certify to 27001, never to 27002.
- Four themes replace 14 domains. Organisational (37), people (8), physical (14) and technological (34), numbered 5.1 to 8.34.
- Eleven controls are new. Threat intelligence, cloud services, ICT readiness, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.
- Attributes are the real upgrade. Five attribute types let you filter the set by control type, security property, CSF function, operational capability or security domain, and build views for each team.
- Evidence, not wording, passes audits. Each applicable control needs an owner, an implementation statement and evidence that it operates; 27002 is the yardstick for what "implemented" means.
ISO 27001 vs ISO 27002
| Aspect | ISO/IEC 27001:2022 | ISO/IEC 27002:2022 |
|---|---|---|
| Purpose | Requirements for an information security management system (ISMS) | Reference set of information security controls with implementation guidance |
| Certification | Yes, by accredited certification bodies | No; used inside an ISMS or on its own as a control catalogue |
| Control content | Annex A: control number, title and a one-line control statement | Per control: attribute table, control, purpose, guidance, other information |
| How controls are used | Clause 6.1.3: compare selected controls with Annex A and produce a Statement of Applicability | Guidance for designing and assessing each control |
| Edition | Edition 3, October 2022; Amendment 1:2024 (Climate action changes) | Edition 3, February 2022; no amendment listed by ISO |
| Length | Short requirements standard | 152 pages |
The climate amendment applies to ISO/IEC 27001:2022 itself; ISO lists no amendment to ISO/IEC 27002:2022, so the control set described here is current.
How ISO/IEC 27002:2022 is structured
The Standards Council of Canada summarises the 2022 revision: "Controls are reduced from 114 to 93: there are 11 new controls, 24 merged controls, and 58 updated controls", and they are "organized in four sections instead of 14".
| Theme (clause) | Range | Controls | New in 2022 | Scope |
|---|---|---|---|---|
| Organisational controls (clause 5) | 5.1 to 5.37 | 37 | 3 | Governance, assets, access, suppliers, incidents, continuity, compliance |
| People controls (clause 6) | 6.1 to 6.8 | 8 | 0 | Controls applied to individuals across employment |
| Physical controls (clause 7) | 7.1 to 7.14 | 14 | 1 | Premises, equipment and media |
| Technological controls (clause 8) | 8.1 to 8.34 | 34 | 7 | Systems, networks, applications and data |
- Control layout: each control has a title, an attribute table, the control statement, its purpose, guidance and other information.
- Control objectives replaced by purpose: the 2013 edition grouped controls under shared control objectives; the 2022 edition gives each control its own purpose statement. Searches for "ISO 27002 control objectives" usually mean these purpose statements now.
- Annexes: Annex A explains how to use attributes to build different views of the controls; Annex B maps the 2022 controls to the 2013 identifiers.
Organisational controls (5.1 to 5.37)
| Controls | Titles |
|---|---|
| 5.1 to 5.6 | Policies for information security; Information security roles and responsibilities; Segregation of duties; Management responsibilities; Contact with authorities; Contact with special interest groups |
| 5.7 to 5.8 | Threat intelligence (new); Information security in project management |
| 5.9 to 5.14 | Inventory of information and other associated assets; Acceptable use of information and other associated assets; Return of assets; Classification of information; Labelling of information; Information transfer |
| 5.15 to 5.18 | Access control; Identity management; Authentication information; Access rights |
| 5.19 to 5.23 | Information security in supplier relationships; Addressing information security within supplier agreements; Managing information security in the ICT supply chain; Monitoring, review and change management of supplier services; Information security for use of cloud services (new) |
| 5.24 to 5.28 | Information security incident management planning and preparation; Assessment and decision on information security events; Response to information security incidents; Learning from information security incidents; Collection of evidence |
| 5.29 to 5.30 | Information security during disruption; ICT readiness for business continuity (new) |
| 5.31 to 5.37 | Legal, statutory, regulatory and contractual requirements; Intellectual property rights; Protection of records; Privacy and protection of PII; Independent review of information security; Compliance with policies, rules and standards for information security; Documented operating procedures |
- Annex A 5.15 Access control: the policy-level access control rule set, which merged the 2013 access control policy and network access controls. It anchors 5.16 to 5.18 and technological controls 8.2 to 8.5. See the Authorisation Models Guide.
- Annex A 5.23 Information security for use of cloud services: covers acquiring, using, managing and exiting cloud services. Evidence usually includes a cloud service inventory, shared responsibility analysis per provider and exit planning. See the Cloud Security Guide.
- Annex A 5.7 Threat intelligence: collecting and analysing threat information and using it in risk and control decisions. Auditors look for sources, analysis and a documented decision that came from it. See the Threat Intelligence Guide.
People and physical controls (6.1 to 7.14)
People controls: 6.1 Screening; 6.2 Terms and conditions of employment; 6.3 Information security awareness, education and training; 6.4 Disciplinary process; 6.5 Responsibilities after termination or change of employment; 6.6 Confidentiality or non-disclosure agreements; 6.7 Remote working; 6.8 Information security event reporting. The people theme has no new controls; 6.7 renames the 2013 teleworking control and 6.8 merges event and weakness reporting.
Physical controls: 7.1 Physical security perimeters; 7.2 Physical entry; 7.3 Securing offices, rooms and facilities; 7.4 Physical security monitoring (new); 7.5 Protecting against physical and environmental threats; 7.6 Working in secure areas; 7.7 Clear desk and clear screen; 7.8 Equipment siting and protection; 7.9 Security of assets off-premises; 7.10 Storage media; 7.11 Supporting utilities; 7.12 Cabling security; 7.13 Equipment maintenance; 7.14 Secure disposal or re-use of equipment.
Cloud-first organisations often mark several physical controls as inherited from providers. That is valid only if the Statement of Applicability says so and supplier assurance (for example provider certificates and reports) is reviewed under 5.19 to 5.22. Offices, home working and endpoint storage remain in scope.
Technological controls (8.1 to 8.34)
| Controls | Titles |
|---|---|
| 8.1 to 8.5 | User endpoint devices; Privileged access rights; Information access restriction; Access to source code; Secure authentication |
| 8.6 to 8.8 | Capacity management; Protection against malware; Management of technical vulnerabilities |
| 8.9 to 8.12 | Configuration management (new); Information deletion (new); Data masking (new); Data leakage prevention (new) |
| 8.13 to 8.14 | Information backup; Redundancy of information processing facilities |
| 8.15 to 8.17 | Logging; Monitoring activities (new); Clock synchronization |
| 8.18 to 8.19 | Use of privileged utility programs; Installation of software on operational systems |
| 8.20 to 8.23 | Networks security; Security of network services; Segregation of networks; Web filtering (new) |
| 8.24 | Use of cryptography |
| 8.25 to 8.31 | Secure development life cycle; Application security requirements; Secure system architecture and engineering principles; Secure coding (new); Security testing in development and acceptance; Outsourced development; Separation of development, test and production environments |
| 8.32 to 8.34 | Change management; Test information; Protection of information systems during audit testing |
- Annex A 8.9 Configuration management: defined, approved and monitored secure configurations for hardware, software, services and networks. Evidence: baselines (for example CIS Benchmarks), drift reports and change records. See the Cloud Misconfiguration Guide.
- Annex A 8.12 Data leakage prevention: measures on systems, networks and endpoints that process sensitive information. Evidence: classification-driven policies, monitored channels and handled alerts. See the Data Loss Prevention (DLP) Guide.
- Annex A 8.16 Monitoring activities: monitoring networks, systems and applications for anomalous behaviour, building on 8.15 Logging. Evidence: use cases, alert triage records and tuning. See the SIEM Guide.
- Annex A 8.24 Use of cryptography: rules for cryptography and key management, merging the two 2013 cryptographic controls. See the Cryptographic Key Management Guide.
- Annex A 8.28 Secure coding: secure coding principles applied in software development. Evidence: coding standards, training, code review and static analysis results. See the Secure Coding Guide.
The 11 new Annex A controls
| Control | Theme | What auditors typically ask for |
|---|---|---|
| 5.7 Threat intelligence | Organisational | Sources, analysis and examples of intelligence changing a control or risk |
| 5.23 Information security for use of cloud services | Organisational | Cloud inventory, responsibility split, provider assurance, exit plans |
| 5.30 ICT readiness for business continuity | Organisational | Recovery objectives for ICT, tested recovery plans and results |
| 7.4 Physical security monitoring | Physical | Monitoring of premises (alarms, CCTV, guards) and review records |
| 8.9 Configuration management | Technological | Approved baselines and drift detection |
| 8.10 Information deletion | Technological | Retention rules and deletion records, including at suppliers |
| 8.11 Data masking | Technological | Where masking or pseudonymisation is required and how it is applied |
| 8.12 Data leakage prevention | Technological | Policies on channels holding sensitive data and alert handling |
| 8.16 Monitoring activities | Technological | Anomaly detection, alert triage and response evidence |
| 8.23 Web filtering | Technological | Rules restricting access to malicious or unwanted websites |
| 8.28 Secure coding | Technological | Secure coding standards applied in development |
Most organisations already did some of this work; the change is that it now needs an owner, a documented approach and evidence. See the Secure Web Gateway and Web Filtering Guide and the Business Continuity and Disaster Recovery Guide for 8.23 and 5.30.
ISO 27002 control attributes
The Standards Council of Canada notes that "each control in ISO/IEC 27002:2022 is associated with a matrix of five attributes". Attribute values are written as hashtags in the standard so they can be filtered.
| Attribute type | Values | Practical use |
|---|---|---|
| Control type | #Preventive, #Detective, #Corrective | Check the set can detect and recover, not only prevent |
| Information security properties | #Confidentiality, #Integrity, #Availability | Link controls to the property each risk threatens |
| Cybersecurity concepts | #Identify, #Protect, #Detect, #Respond, #Recover | Map to NIST CSF functions for reporting |
| Operational capabilities | 15 values: governance, asset management, information protection, human resource security, physical security, system and network security, application security, secure configuration, identity and access management, threat and vulnerability management, continuity, supplier relationships security, legal and compliance, information security event management, information security assurance | Assign controls to owning teams |
| Security domains | #Governance_and_Ecosystem, #Protection, #Defence, #Resilience | Group controls for management reporting |
- Attributes are optional: organisations may ignore them, use some of them or add their own (for example, a regulatory attribute such as "DORA" or "NIS2", or a cloud responsibility attribute).
- Attribute filtering in practice: filtering #Identity_and_access_management gives the identity team its control list; filtering #Detective across #Technological shows whether detection depends on one or two controls.
ISO 27002 2013 vs 2022
The 2013 edition had 114 controls in 14 clauses (A.5 to A.18). The 2022 revision merged 24, updated 58 and added 11, and introduced the four themes, per-control purpose statements and attributes. Annex B of ISO/IEC 27002:2022 gives the full correspondence.
| 2013 control(s) | 2022 control | Change |
|---|---|---|
| A.5.1.1, A.5.1.2 | 5.1 Policies for information security | Merged |
| A.9.1.1, A.9.1.2 | 5.15 Access control | Merged |
| A.9.2.1 User registration and de-registration | 5.16 Identity management | Renamed and broadened |
| A.9.4.2 Secure log-on procedures | 8.5 Secure authentication | Renamed |
| A.6.2.2 Teleworking | 6.7 Remote working | Renamed |
| A.12.2.1 Controls against malware | 8.7 Protection against malware | Renamed |
| A.8.3.1, A.8.3.2, A.8.3.3, A.11.2.5 | 7.10 Storage media | Merged (removable media, disposal, transfer, removal of assets) |
| A.12.4.1, A.12.4.2, A.12.4.3 | 8.15 Logging | Merged |
| A.10.1.1, A.10.1.2 | 8.24 Use of cryptography | Merged |
| None | 5.7, 5.23, 5.30, 7.4, 8.9 to 8.12, 8.16, 8.23, 8.28 | New |
Certification transition deadlines and audit timing are covered in the parent guide. For mapping work across several frameworks, see the Control Mapping Guide.
Implementing ISO 27002 controls
- Start from risk, not the list: run the risk assessment (ISO/IEC 27001 clause 6.1.2, with ISO/IEC 27005:2022 as guidance) and select controls that treat the risks. Annex A is a completeness check, not a shopping list.
- Build the Statement of Applicability: for all 93 controls record applicable or not, the justification, implementation status and a link to evidence.
- Assign owners using attributes: tag each applicable control with an operational capability and give that capability a named owner.
- Write implementation statements: one paragraph per control in your own words saying what you do, using the 27002 guidance as the benchmark. Do not paste ISO text into internal documents shared outside licensed users.
- Define evidence and frequency: for each control, what proves it works (a report, a ticket sample, a configuration export) and how often it is produced.
- Pilot with internal audit: audit a sample of controls, including at least three new ones, before the certification body does. Fix design gaps first, then operating gaps.
- Operate and monitor: automate evidence where possible and review exceptions. See the Compliance Automation Guide.
- Small organisations: many controls are covered by a few platform settings and suppliers; spend effort on 5.9 inventory, 5.15 to 5.18 access, 8.8 vulnerabilities, 8.13 backup and 5.19 to 5.23 suppliers and cloud.
- Large organisations: use attributes to split ownership, add custom attributes for regulations, and maintain one common control set mapped to ISO, NIST and sector rules rather than parallel control lists.
- Using 27002 without certification: it works as a control catalogue for any programme; state that the organisation "aligns with" rather than "complies with" it.
Where identity fits
Identity spans both organisational and technological themes: 5.15 Access control, 5.16 Identity management, 5.17 Authentication information and 5.18 Access rights set the rules; 8.2 Privileged access rights, 8.3 Information access restriction, 8.5 Secure authentication and 8.18 Use of privileged utility programs enforce them. Service accounts, API keys and AI agents are identities under 5.16 and their secrets are authentication information under 5.17; auditors increasingly sample them. See the Service Account Security Guide and the Secrets Management Guide.
Measurement and mapping to other frameworks
- Control coverage: applicable controls with a named owner, implementation statement and current evidence.
- Evidence freshness: controls whose evidence is older than its defined frequency.
- Audit findings by theme: nonconformities and observations per theme and per new control.
- Detective balance: share of applicable controls tagged #Detective or #Corrective.
- Exception count: applicable controls partly implemented under an accepted risk.
NIST publishes an official crosswalk from SP 800-53 Rev. 5 to ISO/IEC 27001:2022 and notes that such crosswalks are not one-to-one. The pairs below are indicative starting points, not equivalence.
| ISO/IEC 27002:2022 | NIST SP 800-53 Rev. 5 (indicative) | CIS Controls v8.1 (indicative) |
|---|---|---|
| 5.9 Inventory of information and other associated assets | CM-8 | Controls 1 and 2 |
| 5.15 to 5.18 Access control and identity | AC-2, AC-3, IA-2, IA-5 | Controls 5 and 6 |
| 8.8 Management of technical vulnerabilities | RA-5, SI-2 | Control 7 |
| 8.9 Configuration management | CM-2, CM-6 | Control 4 |
| 8.13 Information backup | CP-9 | Control 11 |
| 8.15 Logging and 8.16 Monitoring activities | AU-2, AU-12, SI-4 | Controls 8 and 13 |
| 5.19 to 5.23 Suppliers and cloud | SA-9, SR-3 | Control 15 |
| 8.25 to 8.29 Secure development | SA-8, SA-11, SA-15 | Control 16 |
Common failure patterns
- Statement of Applicability copied from a template: every control marked applicable and implemented, with no link to risks or evidence.
- Old numbering in live documents: policies and supplier questionnaires still citing A.9 or A.12.4, so evidence cannot be traced to current controls.
- New controls declared, not built: threat intelligence as a newsletter subscription, or monitoring activities with no triage records.
- Inherited controls assumed: cloud provider certificates used for physical and infrastructure controls without reviewing scope or the customer's share.
- Attributes ignored: ownership by document rather than by capability, leaving controls such as 8.10 Information deletion with no owner.
- Non-human identities left out: access reviews and authentication evidence cover people only, while service accounts and keys go unsampled.
Practitioner checklist
- Buy and read ISO/IEC 27002:2022 for every control you mark applicable; do not rely on summaries.
- Re-number every live policy, standard and questionnaire to the 2022 control IDs.
- Record applicability, justification, status and evidence for all 93 controls in the Statement of Applicability.
- Assign each applicable control an owner through its operational capability attribute.
- Write an evidence definition and frequency for each control.
- Internally audit the 11 new controls before the certification audit.
- Check the balance of preventive, detective and corrective controls using attributes.
- Include service accounts, API keys and AI agents in 5.16, 5.17, 5.18 and 8.2 evidence.
- Maintain one control set mapped to ISO, NIST and CIS rather than parallel lists.
Standards and references
- ISO: ISO/IEC 27002:2022, Information security controls
- ISO: ISO/IEC 27001:2022, Information security management systems: Requirements
- ISO: ISO/IEC 27001:2022/Amd 1:2024, Climate action changes
- ISO: ISO/IEC 27005:2022, Guidance on managing information security risks
- Standards Council of Canada: Publication of ISO/IEC 27002:2022
- BSI: An important information security standard has been revised
- NIST: SP 800-53 Rev. 5 and crosswalk to ISO/IEC 27001:2022
- BCS Information Security Specialist Group: ISO/IEC 27002:2022 briefing
Related NHI Mgmt Group resources: ISO 27001 Certification Guide · Control Mapping Guide · NIST SP 800-53 Guide · CIS Controls Guide · SOC 2 Guide