ISO 27002

The 2022 edition, retitled "Information security, cybersecurity and privacy protection - Information security controls", replaced the 114 controls in 14 clauses of the 2013 edition with 93 controls in four themes: organisational (clause 5, 37 controls), people (clause 6, 8), physical (clause 7, 14) and technological (clause 8, 34). Every control follows the same template: a control statement, a purpose, guidance and other information. The control statements are the same short texts that appear in ISO/IEC 27001 Annex A, so the Annex A entry says what, and the 27002 entry explains why and how.

Eleven controls were new in 2022: 5.7 threat intelligence, 5.23 information security for use of cloud services, 5.30 ICT readiness for business continuity, 7.4 physical security monitoring, 8.9 configuration management, 8.10 information deletion, 8.11 data masking, 8.12 data leakage prevention, 8.16 monitoring activities, 8.23 web filtering and 8.28 secure coding. Many older controls were merged rather than removed; Annex B of the standard maps each 2022 control back to its 2013 predecessors, which is what organisations used when moving their SoA to the new edition.

A second structural addition is attributes, hashtag-style tags that let the same controls be viewed in different ways: control type (#Preventive, #Detective, #Corrective), information security properties (#Confidentiality, #Integrity, #Availability), cybersecurity concepts (#Identify, #Protect, #Detect, #Respond, #Recover, borrowed from the NIST CSF functions), operational capabilities and security domains. Annex A of 27002 explains how to filter by them, for example to list all detective controls that support availability, and organisations may define their own attributes.

Because it is guidance, 27002 uses "should" throughout and cannot be certified against; an auditor assesses the organisation against 27001 and uses 27002 as a reference for what a reasonable implementation looks like. A common mistake is treating the guidance text as a checklist that must be followed word for word, when the actual obligation is the risk-based selection documented in the SoA. Sector documents such as ISO/IEC 27017 (cloud), 27018 (personal data in public clouds) and 27019 (energy utilities) extend the controls with sector-specific guidance, while the CIS Controls offer a more prescriptive, prioritised set of technical safeguards that can sit underneath the technological theme.