ISO 27002:2022: every control, and what you already have

96 controls 124 frameworks share controls with it International verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

ISO/IEC 27002:2022 Information Security Controls Evidence & Implementation Kit

96 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
NIST SP 800-53 Rev 5	93	measure it →
SOC 2	93	measure it →
ISO 27001:2022	92	measure it →
C5 (Germany)	90	measure it →
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1	90	measure it →
FedRAMP High	90	measure it →
FedRAMP Moderate	90	measure it →
NIST SP 800-53 Rev 5 MODERATE	90	measure it →
NIST SP 800-53 Revision 5.1 HIGH	90	measure it →
NIST Cybersecurity Framework 2.0	88	measure it →
NIST SP 800-53 Rev 5 LOW	86	measure it →
PCI DSS 4.0	85	measure it →

Every control

Code	Control	Also in
`4.1`	Clauses	0
`4.2`	Themes and attributes	0
`4.3`	Control layout	0
`5.1`	Policies for information security	43
`5.10`	Acceptable use of information and other associated assets	28
`5.11`	Return of assets	22
`5.12`	Classification of information	31
`5.13`	Labelling of information	22
`5.14`	Information transfer	41
`5.15`	Access control	35
`5.16`	Identity management	34
`5.17`	Authentication information	32
`5.18`	Access rights	34
`5.19`	Information security in supplier relationships	42
`5.2`	Information security roles and responsibilities	43
`5.20`	Addressing information security within supplier agreements	35
`5.21`	Managing information security in the ICT supply chain	35
`5.22`	Monitoring, review and change management of supplier services	33
`5.23`	Information security for use of cloud services	34
`5.24`	Information security incident management planning and preparation	45
`5.25`	Assessment and decision on information security events	37
`5.26`	Response to information security incidents	45
`5.27`	Learning from information security incidents	35
`5.28`	Collection of evidence	29
`5.29`	Information security during disruption	31
`5.3`	Segregation of duties	29
`5.30`	ICT readiness for business continuity	35
`5.31`	Legal, statutory, regulatory and contractual requirements	34
`5.32`	Intellectual property rights	11
`5.33`	Protection of records	38
`5.34`	Privacy and protection of PII	27
`5.35`	Independent review of information security	48
`5.36`	Compliance with policies, rules and standards for information security	38
`5.37`	Documented operating procedures	31
`5.4`	Management responsibilities	30
`5.5`	Contact with authorities	42
`5.6`	Contact with special interest groups	26
`5.7`	Threat intelligence	35
`5.8`	Information security in project management	26
`5.9`	Inventory of information and other associated assets	41
`6.1`	Screening	29
`6.2`	Terms and conditions of employment	26
`6.3`	Information security awareness, education and training	46
`6.4`	Disciplinary process	17
`6.5`	Responsibilities after termination or change of employment	22
`6.6`	Confidentiality or non-disclosure agreements	28
`6.7`	Remote working	27
`6.8`	Information security event reporting	36
`7.1`	Physical security perimeters	32
`7.10`	Storage media	28
`7.11`	Supporting utilities	17
`7.12`	Cabling security	15
`7.13`	Equipment maintenance	22
`7.14`	Secure disposal or re-use of equipment	32
`7.2`	Physical entry	27
`7.3`	Securing offices, rooms and facilities	21
`7.4`	Physical security monitoring	27
`7.5`	Protecting against physical and environmental threats	18
`7.6`	Working in secure areas	18
`7.7`	Clear desk and clear screen	20
`7.8`	Equipment siting and protection	22
`7.9`	Security of assets off-premises	27
`8.1`	User endpoint devices	31
`8.10`	Information deletion	31
`8.11`	Data masking	17
`8.12`	Data leakage prevention	28
`8.13`	Information backup	36
`8.14`	Redundancy of information processing facilities	22
`8.15`	Logging	43
`8.16`	Monitoring activities	47
`8.17`	Clock synchronization	17
`8.18`	Use of privileged utility programs	27
`8.19`	Installation of software on operational systems	32
`8.2`	Privileged access rights	34
`8.20`	Networks security	34
`8.21`	Security of network services	29
`8.22`	Segregation of networks	36
`8.23`	Web filtering	23
`8.24`	Use of cryptography	39
`8.25`	Secure development life cycle	30
`8.26`	Application security requirements	30
`8.27`	Secure system architecture and engineering principles	30
`8.28`	Secure coding	26
`8.29`	Security testing in development and acceptance	29
`8.3`	Information access restriction	34
`8.30`	Outsourced development	23
`8.31`	Separation of development, test and production environments	25
`8.32`	Change management	49
`8.33`	Test information	17
`8.34`	Protection of information systems during audit testing	21
`8.4`	Access to source code	19
`8.5`	Secure authentication	39
`8.6`	Capacity management	23
`8.7`	Protection against malware	33
`8.8`	Management of technical vulnerabilities	42
`8.9`	Configuration management	55

Tell me when ISO 27002:2022 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What this page is

A control-level reference for ISO 27002:2022, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition