ISO/IEC 27002:2022 — Information Security Controls

Why does it matter?

ISO/IEC 27002:2022 is where an ISMS gets its control catalog. ISO/IEC 27001 requires an organization to choose controls through risk treatment, and this standard supplies a numbered set of controls with the guidance to apply each one. Its Introduction is clear that the set is a reference, not a checklist: controls are determined by risk assessment, legal and contractual requirements, and the organization's own business requirements (0.2 and 0.4).

Key benefits include:

• A shared control vocabulary

A control is defined as a measure that maintains or modifies risk (Clause 3.1.8), and the 93 controls are numbered 5.1 to 8.34, so policies, evidence and audit findings can cite one identifier.

• Guidance with every control

Each control is laid out as title, attribute table, control, purpose, guidance and other information (Clause 4.3), so implementers see why the control exists as well as what it says.

• Views for different audiences

Five attributes let an organization filter and sort the controls by control type, information security property, cybersecurity concept, operational capability or security domain (Clause 4.2 and Annex A).

• Current technology is covered

Eleven controls are new in this edition, including threat intelligence (5.7), information security for use of cloud services (5.23), data masking (8.11), data leakage prevention (8.12) and web filtering (8.23).

• Suits any organization

The Introduction says the document is designed for organizations of all types and sizes, public and private, commercial and non-profit (0.1).

How does it work?

Clauses 1 to 4 set the frame: scope (1), no normative references (2), terms and definitions (3) and structure (4). Clause 4.1 lists the four theme clauses (5 to 8) and two informative annexes: Annex A on using attributes and Annex B on correspondence with ISO/IEC 27002:2013.

Themes sort the controls: a control is a people control if it concerns individual people, physical if it concerns physical objects, technological if it concerns technology, and otherwise organizational (Clause 4.2). Attributes cut across the themes and are written with a hash so they can be searched, for example #Preventive, #Confidentiality or #Identify. Control type is Preventive, Detective or Corrective; the cybersecurity concepts follow ISO/IEC TS 27110 (Identify, Protect, Detect, Respond, Recover).

Selecting controls is the organization's decision. Clause 0.4 says it follows a risk assessment with a clearly defined scope, the risk acceptance criteria and risk treatment options, and relevant national and international legislation; the organization can design controls or take them from any source, and ISO/IEC 27005 gives further guidance on risk treatment. Clause 0.5 adds that the standard is a starting point for organization-specific guidelines and that additional controls can be required.

Key Elements

• Organizational controls (Clause 5)

37 controls from policies for information security (5.1) to documented operating procedures (5.37), including threat intelligence (5.7), supplier relationships (5.19 to 5.22), use of cloud services (5.23), incident management (5.24 to 5.28) and ICT readiness for business continuity (5.30).

• People controls (Clause 6)

8 controls from screening (6.1) to information security event reporting (6.8), including awareness, education and training (6.3) and remote working (6.7).

• Physical controls (Clause 7)

14 controls from physical security perimeters (7.1) to secure disposal or re-use of equipment (7.14), including physical security monitoring (7.4).

• Technological controls (Clause 8)

34 controls from user endpoint devices (8.1) to protection of information systems during audit testing (8.34), including configuration management (8.9), information deletion (8.10), monitoring activities (8.16) and secure coding (8.28).

• Five attributes (Clause 4.2)

Control type, information security properties, cybersecurity concepts, operational capabilities and security domains, each with defined values that every control carries in its attribute table.

• Control layout (Clause 4.3)

Control title, attribute table, control, purpose, guidance and other information, with subheadings in longer guidance.

• Using attributes (Annex A, informative)

Explains how to create views from the supplied attributes or from attributes the organization defines for itself.

• Correspondence with 2013 (Annex B, informative)

Shows how the controls of this edition relate to the 2013 edition, including merged, deleted and new controls.

What does it cover?

ISO/IEC 27002:2022 provides a reference set of generic information security controls including implementation guidance. Clause 1 says it is designed to be used by organizations within the context of an ISMS based on ISO/IEC 27001, for implementing information security controls based on internationally recognized best practices, and for developing organization-specific information security management guidelines. It applies to organizations of all types and sizes (Introduction 0.1).

What are its objectives?

The Introduction sets out what the standard is for:

To be a reference for determining and implementing controls for information security risk treatment in an ISMS based on ISO/IEC 27001 (0.1).

To guide organizations that determine and implement commonly accepted information security controls (0.1).

To help meet the three sources of security requirements: the organization's risk assessment, legal, statutory, regulatory and contractual requirements, and its own principles and business requirements for the life cycle of information (0.2).

To let organizations decide controls by risk, and to keep a balance between the resources spent on controls and the business impact of incidents without them (0.4).

To support security at every stage of the life cycle of information and of the systems that hold it (0.6).

Framework in Context

ISO/IEC 27001:2022 sets the certifiable ISMS requirements. It requires the controls an organization determines to be compared with its Annex A and a Statement of Applicability to be produced (Clause 6.1.3 c and d), and its Foreword states that the text was aligned with ISO/IEC 27002:2022. ISO/IEC 27005:2022 gives guidance on managing information security risks, which is the step that decides which controls are needed. The Introduction names sector standards that add controls: ISO/IEC 27017 for cloud services, ISO/IEC 27701 for privacy, ISO/IEC 27019 for energy, ISO/IEC 27011 for telecommunications organizations and ISO 27799 for health (0.7). This third edition replaces the 2013 edition, which had 14 clauses and 114 controls; ISO lists no amendment and no revision under development.

Common Framework Mappings

ISO/IEC 27002:2022 is commonly mapped to the ISMS, privacy, cloud and control frameworks that reuse its controls, so one set of controls and one body of evidence can serve several programs.

Mapped frameworks include:

CIS Controls v8.1

ISO 27001:2022

ISO/IEC 27013

ISO 27017

ISO 27018

ISO 27701

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2