ISO 27002
control catalogue and implementation guidance
ISO 27002:2022 is the implementation companion to ISO 27001. It describes 93 information security controls across organisational, people, physical, and technological themes, and the attributes that classify each control. This page covers how to read the catalogue, how it maps to ISO 27001 Annex A, and how to evidence control operation in a workspace.
No credit card required. Free plan available forever.
ISO 27002 in context: the implementation companion to ISO 27001
ISO 27002 is the international standard for information security controls. The 2022 revision (ISO/IEC 27002:2022) restructured the catalogue from 14 domains and 114 controls into 4 themes and 93 controls, introduced 11 new controls, and added a five-attribute taxonomy that cross-cuts the theme structure. ISO 27002 supplies the implementation guidance, purpose statements, and worked detail behind each control; it does not certify and is not normative on its own.
The relationship most teams need to keep clear is the split between ISO 27001 and ISO 27002. The ISO 27001 framework page covers the management system standard: the requirements an organisation meets to certify its ISMS. ISO 27001:2022 Annex A states the 93 controls in single sentences and is the certifiable obligation. ISO 27002:2022 carries the same 93 controls and adds the implementation guidance. The Statement of Applicability cites ISO 27001; the implementation evidence is grounded against ISO 27002. Treating one as a substitute for the other is the root cause of most early-stage SoA failures.
The four themes at a glance
ISO 27002:2022 organises the 93 controls into four themes. The themes are not a domain hierarchy in the 2013 sense; they are a top-level grouping that lets a reader navigate the catalogue without flattening the cross-cutting attributes underneath. The number of controls per theme is intentional rather than incidental: organisational controls dominate because most security work is governance work, technological controls run a close second because most evidence work is engineering work.
Theme 5: Organisational (37 controls)
Programme governance, policy ownership, segregation of duties, threat intelligence, supplier and cloud service relationships, asset inventories, information classification, identity and access management at the policy layer, and incident management governance. Theme 5 holds the controls that say "the organisation must do X", with implementation usually delegated to other teams.
Theme 6: People (8 controls)
Screening, terms and conditions of employment, security awareness and training, disciplinary processes, responsibilities after termination or change of employment, confidentiality agreements, remote working, and information security event reporting. Theme 6 is where HR processes and security policy meet.
Theme 7: Physical (14 controls)
Physical security perimeters, entry controls, securing offices and facilities, physical security monitoring, protection against environmental threats, clear desk and clear screen, equipment siting and protection, and secure disposal or reuse of equipment. Theme 7 covers the physical environment whether the organisation owns the building, leases it, or operates from co-working space.
Theme 8: Technological (34 controls)
The largest theme. User endpoint devices, privileged access rights, information access restriction, secure authentication, capacity management, malware protection, technical vulnerability management, configuration management, network security, secure development lifecycle, cryptography, logging, and protection against malware. Theme 8 is where most penetration testing and scanner work generates evidence.
The five attribute axes
The 2022 revision introduced a hashtag-style attribute set that runs across all 93 controls. Each control carries values on five axes, which lets a team navigate the catalogue from any of those angles without restructuring it. Attributes complement the four themes; they do not replace them. The attribute set is one of the most useful additions in the 2022 revision because it lets a CISO or compliance lead pull a coherent slice of the catalogue without rewriting the controls.
- Control type: preventive, detective, or corrective. Names whether the control stops the threat from materialising, surfaces it after it does, or restores the state once it has.
- Information security properties: confidentiality, integrity, and availability. The CIA triad applied at control granularity rather than at the system level.
- Cybersecurity concepts: identify, protect, detect, respond, and recover. The NIST CSF functions used as cross-walks so an ISO 27002 implementer can match controls to NIST CSF deliverables without rebuilding the mapping.
- Operational capabilities: governance, asset management, identity and access management, supplier relationships security, secure configuration, and similar capability families. Attributes let a team filter the catalogue by the function the control supports rather than by the theme it sits in.
- Security domains: governance and ecosystem, protection, defence, and resilience. The fourth axis groups controls by where they sit in the protect-defend-resilience continuum.
The attribute most often misused is “cybersecurity concepts” because its values map to the NIST CSF functions. The right reading is that the attribute provides a cross-walk to NIST CSF, not that ISO 27002 inherits NIST CSF semantics. For organisations running both, the NIST Cybersecurity Framework page covers the underlying NIST function model and the NIST 800-53 framework page covers the federal control catalogue many organisations align to alongside ISO 27002.
Eleven new controls in ISO 27002:2022
The 2022 revision did not relax obligations; it codified work that the 2013 version addressed obliquely or distributed across multiple older controls. The eleven new controls below are the ones an existing ISMS most often needs to add evidence for during the migration to the 2022 standard.
5.7 Threat intelligence
Information relating to information security threats is collected and analysed to produce threat intelligence. The control formalises threat intelligence as an organisational function rather than treating it as an unstructured by-product of the security operations centre.
5.23 Information security for use of cloud services
Processes for the acquisition, use, management, and exit from cloud services are defined in line with the organisation is information security requirements. The control codifies cloud-specific risk management as a discrete obligation rather than folding it into supplier relationships.
5.30 ICT readiness for business continuity
ICT readiness is planned, implemented, maintained, and tested based on business continuity objectives and ICT continuity requirements. The control distinguishes information and communications technology continuity from broader business continuity, which is treated under business continuity standards.
7.4 Physical security monitoring
Premises are continuously monitored for unauthorised physical access. The control elevates physical monitoring from a sub-element of entry controls to a named obligation with its own evidence requirements.
8.9 Configuration management
Configurations of hardware, software, services, and networks are established, documented, implemented, monitored, and reviewed. The control gives the secure baseline a dedicated control rather than scattering it across operations management.
8.10 Information deletion
Information stored in information systems, devices, or in any other storage media is deleted when no longer required. The control names data lifecycle disposal explicitly, which the 2013 version covered only obliquely.
8.11 Data masking
Data masking is used in accordance with the organisation is topic-specific policy on access control and other related policies, and applicable legislation. The control codifies a technique commonly used for development and analytics environments handling production data.
8.12 Data leakage prevention
Data leakage prevention measures are applied to systems, networks, and any other devices that process, store, or transmit sensitive information. The control names DLP as a dedicated obligation rather than a side product of network monitoring.
8.16 Monitoring activities
Networks, systems, and applications are monitored for anomalous behaviour and appropriate actions are taken to evaluate potential information security incidents. The control formalises continuous monitoring beyond logging.
8.23 Web filtering
Access to external websites is managed to reduce exposure to malicious content. The control names web filtering as a discrete control rather than treating it as an instance of malware protection.
8.28 Secure coding
Secure coding principles are applied to software development. The control distinguishes secure coding practices from broader secure development lifecycle obligations covered elsewhere.
Several of the new controls land squarely in penetration testing scope. Configuration management (8.9), monitoring activities (8.16), and secure coding (8.28) are evidenced by engagement output that a security testing programme already produces. The discipline is linking that output to the specific control identifier rather than letting the evidence float in a separate document. For technical vulnerability management (8.8), the remediation tracking workflow carries the closure evidence the audit asks for.
Mapping ISO 27002 to ISO 27001 Annex A
- ISO 27001:2022 Annex A is the normative control set. It states each of the 93 controls in a single objective sentence with no implementation detail. Annex A is what the Statement of Applicability cites and what the certification audit verifies.
- ISO 27002:2022 is the guidance companion. It carries the same 93 controls and adds, per control, a purpose statement, implementation guidance, and the five attribute hashtags. ISO 27002 is informative rather than normative; it explains how to implement the Annex A obligation rather than restating it.
- The control numbering is identical across the two standards. Control 8.7 in ISO 27001 Annex A is control 8.7 in ISO 27002, with the Annex A text being the obligation and the ISO 27002 text being the implementation guidance.
- ISO 27002:2013 (the prior version) used a 14-domain structure with 114 controls. The 2022 revision consolidated to four themes with 93 controls. Controls were merged, renumbered, and 11 new controls were added; no obligations were removed in substance, but several were renumbered in ways that break old SoA documents that copy old control identifiers verbatim.
- Other ISO 27001 family standards extend the catalogue for sector or context: ISO 27017 for cloud services, ISO 27018 for personally identifiable information in public clouds, ISO 27701 for privacy information management. Each cites ISO 27002 as the baseline and adds sector-specific controls on top.
Practical implication: the Statement of Applicability is structured around ISO 27001 Annex A control identifiers, and the implementation evidence is structured around the corresponding ISO 27002 guidance per control. Teams that built their SoA against ISO 27001:2013 carry old domain numbers and need an explicit migration step before the next surveillance audit. The ISO 27001 audit checklist covers the upstream surveillance and recertification rhythm that consumes the SoA and the per-control evidence. For organisations that operate cloud workloads in the certification scope, the ISO 27017 framework page covers the cloud-specific extension that adds seven CLD controls and per-control cloud guidance on top of the ISO 27002 catalogue. Where the cloud workload processes personal data on behalf of customers, the ISO 27018 framework page covers the public cloud PII processor obligations that layer on top of ISO 27017 and ISO 27002.
Building the per-control evidence base
Audit findings against ISO 27001 most often centre on evidence rather than on control intent. The control is in the SoA, the policy is written, and the team can describe what the control does, but the artefact a certification body asks for is missing or stale. The evidence model below is what survives surveillance review.
- Each ISO 27002 control has a purpose statement (why the control exists), an implementation guidance block (how to implement it), and the attribute hashtags (where it sits in the cross-cutting taxonomies). The audit trail per control should reference all three.
- For technological controls (Theme 8), the evidence base usually includes scanner output, configuration snapshots, vulnerability management records, and penetration testing findings. The control text describes the obligation; the workspace holds the evidence the obligation produced.
- For organisational controls (Theme 5), the evidence base includes policy documents, the policy review log, the management approval record, and the topic-specific policies (access control, classification, supplier security) that inherit from the master information security policy.
- For people controls (Theme 6), the evidence base spans HR systems and security systems: screening records, training completion, awareness campaign engagement, the disciplinary process documentation, and the post-employment access revocation log.
- For physical controls (Theme 7), evidence is grounded in facilities records: site survey reports, monitoring system records, access card logs, environmental monitoring output, and the equipment disposal certificates that close the lifecycle.
- The Statement of Applicability records each control as included or excluded with a justification per exclusion. Controls included carry a status and an evidence pointer; controls excluded carry a justification that survives the audit.
For pentest and vulnerability evidence specifically, the discipline is anchoring each finding to the controls it bears on. A SQL injection finding evidences technical vulnerability management (8.8), secure coding (8.28), and access control (5.15 to 5.18) depending on the failure mode. The SQL injection guide and the broken access control guide cover the technical context behind those findings, and the pentest evidence management workflow covers the durability discipline that keeps the linked evidence intact across engagements.
How SecPortal aligns to ISO 27002 implementation work
SecPortal is the workspace that holds the engagement, the findings record, and the audit trail that the SoA implementation evidence references. The platform does not certify the ISMS and is not a substitute for the certification body audit, but it does hold the work the implementation team relies on when building and maintaining the per-control evidence base.
- Compliance tracking with pre-built ISO 27001:2022 Annex A control templates that match the ISO 27002:2022 numbering. Each control supports four status levels (compliant, non-compliant, partial, not applicable) and direct evidence attachment.
- Findings management that links pentest and scanner findings to specific Annex A controls so the technological control evidence chain walks from the finding back to the obligation rather than living in a separate document.
- Engagement management that records the assessor work (penetration tests, vulnerability assessments, configuration reviews) the Annex A controls reference. The engagement evidence becomes the implementation evidence per control.
- AI report generation that turns control status data into the narrative compliance summary an audit committee or certification body expects, with the underlying control register and findings record kept available behind the narrative.
- Activity logs that record every status change, evidence upload, and assignment. The log is the audit trail the certification body asks for during surveillance and recertification.
- Continuous monitoring with scheduled scans that keep technological control evidence current rather than letting it stale between audit cycles.
For the technological controls (Theme 8), the platform is most directly load-bearing. Findings link to specific control identifiers, scanner output is preserved at import, and the activity trail records every status change without manual tracking. The scanner output deduplication guide covers how to preserve evidence quality when scanner findings feed into control evidence, and the false positives guide covers the validation discipline that protects the per-control evidence chain.
Common implementation mistakes
The mistakes below recur across organisations migrating from ISO 27002:2013 to the 2022 revision and across organisations implementing ISO 27001 for the first time. Each one is recoverable with a documented correction; each one is hard to recover when discovered at the certification body audit.
- Treating ISO 27002 as the normative standard. ISO 27001 is the management system standard and the source of certification. ISO 27002 is the implementation guidance. Statements of Applicability that cite ISO 27002 in place of ISO 27001 fail audit review.
- Carrying old ISO 27002:2013 control numbers into the SoA after migrating to the 2022 revision. The numbering changed; control identifiers in old policies and templates need explicit remap rather than copy-paste.
- Using attribute hashtags as a substitute for control mapping. Attributes classify controls; they do not replace the obligation. A control marked as "preventive" still has an obligation, an evidence requirement, and a status separate from its attribute set.
- Excluding controls from the SoA without a documented justification. Exclusion is permitted; undocumented exclusion is the most common audit finding because the certification body cannot verify the exclusion rationale on its own.
- Confusing ISO 27017, ISO 27018, and ISO 27701 with ISO 27002. The extension standards layer additional controls on top of ISO 27002 for cloud, PII in public clouds, and privacy management respectively. Citing the wrong standard in the SoA produces an audit gap.
- Treating implementation guidance as a checklist. ISO 27002 guidance is non-prescriptive and context-sensitive; the implementer chooses what is appropriate for the organisation and records the rationale. Mechanical adoption of every guidance bullet without the rationale is both expensive and audit-fragile.
Where ISO 27002 sits alongside other frameworks
Most organisations running ISO 27001 also run at least one other compliance regime, and the controls overlap heavily because the underlying obligations are similar. The page cross-walks below cover the most common parallel regimes that organisations layer on top of an ISO 27002 implementation.
- SOC 2 shares roughly two-thirds of its trust services criteria with ISO 27002 controls, especially in the security and availability categories. Many ISO 27001-certified organisations attach a SOC 2 Type II report to the same control evidence base.
- NIS2 treats ISO 27001 implementation as evidence of the cybersecurity risk management measures Article 21 calls for. The Annex A controls map cleanly to the NIS2 minimum measures.
- DORA draws on ISO 27001/27002 for ICT risk management framework evidence, with sectoral regulations layered on top for financial entities.
- Cyber Essentials is a UK baseline that overlaps with a subset of ISO 27002 technological controls. Smaller organisations sometimes start with Cyber Essentials and graduate to ISO 27001 as procurement requirements grow.
- CMMC draws controls from NIST 800-171 rather than from ISO 27002, but the practical evidence base (vulnerability management, configuration management, monitoring) overlaps substantially.
Scope and limitations
ISO/IEC 27002:2022 is published by the International Organization for Standardization and the International Electrotechnical Commission. SecPortal is the workspace that holds the engagement, the findings, the evidence, and the audit trail; certification under ISO 27001 remains the registrant is responsibility, carried out through an accredited certification body. This page describes the structure of the standard and how a workspace-driven programme plays against the implementation guidance; the authoritative reference for the obligations remains the published standard text and any subsequent ISO and IEC revisions.
Nothing on this page is legal or audit advice. ISO 27001 certification decisions require the involvement of the organisation is information security leadership, internal audit, and the chosen certification body. The platform supports the underlying work record those roles rely on; it does not substitute for the certification body audit that determines whether the ISMS meets the standard.
Key control areas
SecPortal helps you track and manage compliance across these domains.
5: Organisational Controls (37 controls)
Policies for information security, roles and responsibilities, threat intelligence, supplier and cloud service relationships, classification, identity and access management at the policy layer, and information security in project management.
6: People Controls (8 controls)
Screening, terms and conditions of employment, awareness and training, disciplinary process, responsibilities after termination or change of employment, confidentiality agreements, remote working, and information security event reporting.
7: Physical Controls (14 controls)
Physical security perimeters, entry controls, securing offices and facilities, physical security monitoring, protection against environmental threats, working in secure areas, clear desk and clear screen, equipment siting and protection, and secure disposal or reuse of equipment.
8: Technological Controls (34 controls)
User endpoint devices, privileged access rights, information access restriction, secure authentication, capacity management, malware protection, technical vulnerability management, configuration management, network security, secure development lifecycle, and cryptography.
Control attributes (cross-cutting taxonomy)
Each ISO 27002:2022 control carries five attribute hashtags: control type (preventive, detective, corrective), information security properties (confidentiality, integrity, availability), cybersecurity concepts (the NIST CSF functions), operational capabilities, and security domains. Attributes let teams view the catalogue from any of those angles without restructuring it.
Mapping to ISO 27001:2022 Annex A
ISO 27001:2022 Annex A is the same 93 controls, restated in a single line each. ISO 27002:2022 supplies the implementation guidance and purpose statement per control. The Statement of Applicability cites ISO 27001 Annex A; the implementation evidence lives against the ISO 27002 guidance text.
Evidence ISO 27002 controls in one workspace
Track control status, attach evidence, and link findings to specific controls so the audit trail walks back to the work itself.
No credit card required. Free plan available forever.