ISO 27001:2022

International

v2022

6 domains

100 controls

International standard for establishing, implementing, maintaining and continually improving an information security management system (ISMS)

Verified

ISO 27001:2022 is a compliance framework from International with 6 domains and 100 controls that map to 93 other frameworks. The largest domains are Organizational controls – ISO 27001:2022 (37 controls), Technological controls – ISO 27001:2022 (34 controls), Physical controls – ISO 27001:2022 (14 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 18 August 2026Control text last updated 18 August 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

Clause 0 – ISO 27001:2022

2 controls

Clause 9 – ISO 27001:2022

5 controls

Controls in the Clause 9 – ISO 27001:2022 domain of ISO 27001:2022 — 5 controls
Code	Title	Description
iso-27001-2022::9.2.1	General	Conduct internal audits of the information security management system at planned intervals, to establish whether it conf...
iso-27001-2022::9.2.2	Internal audit programme	Plan, establish, implement and maintain an audit programme covering frequency, methods, responsibilities, planning requi...
iso-27001-2022::9.3.1	General	Top management shall review the organisation's information security management system at planned intervals, to ensure it...
iso-27001-2022::9.3.2	Management review inputs	The management review shall consider the status of actions from previous reviews, changes in external and internal issue...
iso-27001-2022::9.3.3	Management review results	The results of the management review shall include decisions related to continual improvement opportunities and to any n...

Organizational controls – ISO 27001:2022

37 controls

Controls in the Organizational controls – ISO 27001:2022 domain of ISO 27001:2022 — 37 controls
Code	Title	Description
iso-27001-2022::5.1	Policies for information security	Write, approve and publish a top-level security policy plus topic-specific policies, and review them on a set cadence an...
iso-27001-2022::5.10	Acceptable use of information and other associated assets	Define and enforce rules for how information and assets may be used and handled.
iso-27001-2022::5.11	Return of assets	Recover all organizational assets on exit or role change.
iso-27001-2022::5.12	Classification of information	Classify information by confidentiality, integrity, availability and interested-party requirements.
iso-27001-2022::5.13	Labelling of information	Label information consistently with the classification scheme so handling rules can follow it.
iso-27001-2022::5.14	Information transfer	Put rules, procedures or agreements in place for every way information moves, inside and outside the organization.
iso-27001-2022::5.15	Access control	Set rules for physical and logical access based on business and security requirements.
iso-27001-2022::5.16	Identity management	Manage the full life cycle of identities.
iso-27001-2022::5.17	Authentication information	Control allocation and handling of passwords, keys and other authentication secrets, and advise users on good practice.
iso-27001-2022::5.18	Access rights	Provision, review, modify and remove access rights in line with the access control policy.
iso-27001-2022::5.19	Information security in supplier relationships	Define and apply processes to manage the security risk suppliers introduce.
iso-27001-2022::5.2	Information security roles and responsibilities	Name who owns what in security and make the allocation explicit and traceable.
iso-27001-2022::5.20	Addressing information security within supplier agreements	Establish and agree the relevant security requirements in each supplier contract.
iso-27001-2022::5.21	Managing information security in the ICT supply chain	Extend security requirements down the ICT products and services supply chain.
iso-27001-2022::5.22	Monitoring, review and change management of supplier services	Regularly monitor, review and manage change in supplier security practice and service delivery.
iso-27001-2022::5.23	Information security for use of cloud services	Govern acquisition, use, management and exit of cloud services against your security requirements.
iso-27001-2022::5.24	Information security incident management planning and preparation	Define incident roles, processes and readiness before an incident happens.
iso-27001-2022::5.25	Assessment and decision on information security events	Triage security events and decide which become incidents.
iso-27001-2022::5.26	Response to information security incidents	Respond to incidents according to the documented procedures.
iso-27001-2022::5.27	Learning from information security incidents	Feed lessons from incidents back into stronger controls.
iso-27001-2022::5.28	Collection of evidence	Have procedures to identify, collect, acquire and preserve evidence related to security events.
iso-27001-2022::5.29	Information security during disruption	Plan how to keep information security at the right level during disruption.
iso-27001-2022::5.3	Segregation of duties	Split conflicting duties so no single person can run a sensitive process end to end unchecked.
iso-27001-2022::5.30	ICT readiness for business continuity	Plan, implement, maintain and test ICT readiness against business continuity objectives.
iso-27001-2022::5.31	Legal, statutory, regulatory and contractual requirements	Identify, document and keep current the legal and contractual obligations relevant to security, and your approach to mee...
iso-27001-2022::5.32	Intellectual property rights	Implement procedures to protect intellectual property and respect licensing.
iso-27001-2022::5.33	Protection of records	Protect records from loss, destruction, falsification, unauthorized access and unauthorized release.
iso-27001-2022::5.34	Privacy and protection of personal identifiable information (PII)	Identify and meet privacy and PII-protection requirements from law, regulation and contract.
iso-27001-2022::5.35	Independent review of information security	Have the security approach and its implementation reviewed independently on a cadence and after significant change.
iso-27001-2022::5.36	Compliance with policies, rules and standards for information security	Regularly check that people actually comply with the security policies, rules and standards.
iso-27001-2022::5.37	Documented operating procedures	Document operating procedures for information processing facilities and make them available to those who need them.
iso-27001-2022::5.4	Management responsibilities	Require every staff member to actually apply the policies and procedures, not just acknowledge them.
iso-27001-2022::5.5	Contact with authorities	Keep working relationships with regulators, law enforcement and CERTs before you need them.
iso-27001-2022::5.6	Contact with special interest groups	Stay plugged into security forums and specialist groups for early warning and shared practice.
iso-27001-2022::5.7	Threat intelligence	Collect and analyse threat information and turn it into decisions, not just unread feeds.
iso-27001-2022::5.8	Information security in project management	Bake security requirements into every project from initiation, whatever the delivery method.
iso-27001-2022::5.9	Inventory of information and other associated assets	Maintain a current asset inventory with owners.

People controls – ISO 27001:2022

8 controls

Controls in the People controls – ISO 27001:2022 domain of ISO 27001:2022 — 8 controls
Code	Title	Description
iso-27001-2022::6.1	Screening	Background-check candidates and personnel proportional to risk and classification, within the law.
iso-27001-2022::6.2	Terms and conditions of employment	State the security responsibilities of both the person and the organization in the employment agreement.
iso-27001-2022::6.3	Information security awareness, education and training	Give personnel and relevant parties appropriate, current security training for their role.
iso-27001-2022::6.4	Disciplinary process	Have a formal, communicated disciplinary process for security policy violations.
iso-27001-2022::6.5	Responsibilities after termination or change of employment	Define and enforce security responsibilities that remain valid after an exit or role change.
iso-27001-2022::6.6	Confidentiality or non-disclosure agreements	Identify, document, review and sign NDAs that reflect the organization's protection needs.
iso-27001-2022::6.7	Remote working	Apply security measures when people access, process or store information outside the organization's premises.
iso-27001-2022::6.8	Information security event reporting	Give people an easy, timely channel to report observed or suspected security events.

Physical controls – ISO 27001:2022

14 controls

Controls in the Physical controls – ISO 27001:2022 domain of ISO 27001:2022 — 14 controls
Code	Title	Description
iso-27001-2022::7.1	Physical security perimeters	Define and use security perimeters to protect areas holding information and assets.
iso-27001-2022::7.10	Storage media	Manage storage media across acquisition, use, transport and disposal per classification and handling rules.
iso-27001-2022::7.11	Supporting utilities	Protect information processing facilities from power failures and other utility disruptions.
iso-27001-2022::7.12	Cabling security	Protect power and data cabling from interception, interference and damage.
iso-27001-2022::7.13	Equipment maintenance	Maintain equipment correctly to preserve availability, integrity and confidentiality.
iso-27001-2022::7.14	Secure disposal or re-use of equipment	Verify that sensitive data and licensed software are removed or securely overwritten before disposal or re-use.
iso-27001-2022::7.2	Physical entry	Protect secure areas with appropriate entry controls and access points.
iso-27001-2022::7.3	Securing offices, rooms and facilities	Design and apply physical security for offices, rooms and facilities.
iso-27001-2022::7.4	Physical security monitoring	Continuously monitor premises for unauthorized physical access.
iso-27001-2022::7.5	Protecting against physical and environmental threats	Design and apply protection against natural disasters and other physical and environmental threats.
iso-27001-2022::7.6	Working in secure areas	Design and apply security measures for working in secure areas.
iso-27001-2022::7.7	Clear desk and clear screen	Enforce clear-desk rules for papers and media and clear-screen rules for processing facilities.
iso-27001-2022::7.8	Equipment siting and protection	Site equipment securely and protect it.
iso-27001-2022::7.9	Security of assets off-premises	Protect assets used or held off-site.

Technological controls – ISO 27001:2022

34 controls

Controls in the Technological controls – ISO 27001:2022 domain of ISO 27001:2022 — 34 controls
Code	Title	Description
iso-27001-2022::8.1	User end point devices	Protect information stored on, processed by or reachable through user endpoints.
iso-27001-2022::8.10	Information deletion	Delete information in systems, devices and media when no longer required.
iso-27001-2022::8.11	Data masking	Use data masking in line with access policy, business need and applicable law.
iso-27001-2022::8.12	Data leakage prevention	Apply data leakage prevention to systems and channels handling sensitive information.
iso-27001-2022::8.13	Information backup	Maintain and regularly test backups of information, software and systems per the backup policy.
iso-27001-2022::8.14	Redundancy of information processing facilities	Build enough redundancy into processing facilities to meet availability requirements.
iso-27001-2022::8.15	Logging	Produce, store, protect and analyse logs of activities, exceptions and faults.
iso-27001-2022::8.16	Monitoring activities	Monitor networks, systems and applications for anomalies and act on potential incidents.
iso-27001-2022::8.17	Clock synchronization	Synchronize system clocks to approved time sources.
iso-27001-2022::8.18	Use of privileged utility programs	Restrict and tightly control utilities that can override system and application controls.
iso-27001-2022::8.19	Installation of software on operational systems	Securely manage software installation on production systems.
iso-27001-2022::8.2	Privileged access rights	Restrict and manage the allocation and use of privileged access.
iso-27001-2022::8.20	Networks security	Secure, manage and control networks and network devices.
iso-27001-2022::8.21	Security of network services	Identify, implement and monitor security mechanisms and service levels for network services.
iso-27001-2022::8.22	Segregation of networks	Segregate groups of services, users and systems in the network.
iso-27001-2022::8.23	Web filtering	Manage access to external websites to reduce exposure to malicious content.
iso-27001-2022::8.24	Use of cryptography	Define and implement rules for effective use of cryptography and key management.
iso-27001-2022::8.25	Secure development life cycle	Establish and apply rules for secure development of software and systems.
iso-27001-2022::8.26	Application security requirements	Identify, specify and approve security requirements when developing or acquiring applications.
iso-27001-2022::8.27	Secure system architecture and engineering principles	Establish and apply secure engineering principles to system development.
iso-27001-2022::8.28	Secure coding	Apply secure coding principles to software development.
iso-27001-2022::8.29	Security testing in development and acceptance	Define and run security testing across the development life cycle.
iso-27001-2022::8.3	Information access restriction	Restrict access to information and assets per the access control policy.
iso-27001-2022::8.30	Outsourced development	Direct, monitor and review outsourced system development.
iso-27001-2022::8.31	Separation of development, test and production environments	Separate and secure development, test and production environments.
iso-27001-2022::8.32	Change management	Put changes to facilities and systems through change management procedures.
iso-27001-2022::8.33	Test information	Select, protect and manage test information appropriately.
iso-27001-2022::8.34	Protection of information systems during audit testing	Plan and agree audit tests on operational systems with management to avoid disruption.
iso-27001-2022::8.4	Access to source code	Appropriately manage read and write access to source code, development tools and libraries.
iso-27001-2022::8.5	Secure authentication	Implement authentication technologies and procedures based on access restrictions and policy.
iso-27001-2022::8.6	Capacity management	Monitor and tune resource use against current and expected capacity needs.
iso-27001-2022::8.7	Protection against malware	Implement malware protection backed by user awareness.
iso-27001-2022::8.8	Management of technical vulnerabilities	Obtain vulnerability information, evaluate exposure, and take appropriate remediation.
iso-27001-2022::8.9	Configuration management	Establish, document, implement, monitor and review secure configurations for hardware, software, services and networks.

Your Compliance Coverage

If you comply with ISO 27001:2022, you already cover:

NIST SP 800-53 Rev 5

100%

93 controls mapped

Compare →

ISO 27002:2022

99%

92 controls mapped

Compare →

SOC 2

99%

92 controls mapped

Compare →

+ 90 more: C5 (Germany) (97%), NIST SP 800-53 Rev 5 MODERATE (97%)

See all 93 mapped frameworks ↓

Maps to 93 other frameworks

93 total controls

NIST SP 800-53 Rev 5

93 source controls mapped|253 target controls covered

100%

ISO 27002:2022

92 source controls mapped|92 target controls covered

99%

SOC 2

92 source controls mapped|60 target controls covered

99%

C5 (Germany)

90 source controls mapped|117 target controls covered

97%

NIST SP 800-53 Rev 5 MODERATE

90 source controls mapped|214 target controls covered

97%

FedRAMP Moderate

90 source controls mapped|293 target controls covered

97%

NIST SP 800-53 Revision 5.1 HIGH

90 source controls mapped|218 target controls covered

97%

FedRAMP High

90 source controls mapped|293 target controls covered

97%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

90 source controls mapped|180 target controls covered

97%

NIST Cybersecurity Framework 2.0

90 source controls mapped|103 target controls covered

97%

PCI DSS 4.0

88 source controls mapped|246 target controls covered

95%

NIST SP 800-53 Rev 5 LOW

86 source controls mapped|123 target controls covered

92%

ISO 27701:2019

82 source controls mapped|100 target controls covered

88%

CIS Controls v8

77 source controls mapped|153 target controls covered

83%

NIST SP 800-161 Rev 1

77 source controls mapped|96 target controls covered

83%

CMMC 2.0

76 source controls mapped|108 target controls covered

82%

NIST SP 800-171 Rev 3

74 source controls mapped|96 target controls covered

80%

HIPAA Security Rule

72 source controls mapped|67 target controls covered

77%

NIST SP 800-66 Rev 2

72 source controls mapped|55 target controls covered

77%

NIS2 Directive

62 source controls mapped|26 target controls covered

67%

AWS Well-Architected Security Pillar

61 source controls mapped|63 target controls covered

66%

Azure Security Benchmark

60 source controls mapped|84 target controls covered

65%

CFTC System Safeguards (17 CFR 37, 38, 39, 49)

59 source controls mapped|23 target controls covered

63%

Australia Consumer Data Right - Banking (CDR)

54 source controls mapped|15 target controls covered

58%

DORA

53 source controls mapped|25 target controls covered

57%

ANSSI Guide d'hygiene informatique (42 mesures, v2.0)

50 source controls mapped|42 target controls covered

54%

NIST SP 800-172

48 source controls mapped|31 target controls covered

52%

EU AI Act

45 source controls mapped|33 target controls covered

48%

ISO 22301:2019

39 source controls mapped|48 target controls covered

42%

ASD Strategies to Mitigate Cyber Security Incidents

36 source controls mapped|37 target controls covered

39%

Australia My Health Records Act 2012

32 source controls mapped|21 target controls covered

34%

ISO/IEC 42001:2023

32 source controls mapped|33 target controls covered

34%

ACSC Essential Eight

31 source controls mapped|20 target controls covered

33%

NIST SP 800-218

29 source controls mapped|42 target controls covered

31%

APRA CPS 230 Operational Risk Management

29 source controls mapped|35 target controls covered

31%

GDPR

27 source controls mapped|12 target controls covered

29%

APRA CPS 234

27 source controls mapped|24 target controls covered

29%

UK Cyber Essentials

21 source controls mapped|31 target controls covered

23%

APPI

20 source controls mapped|18 target controls covered

22%

Authorised Economic Operator (AEO) Programmes - Global Standards

20 source controls mapped|11 target controls covered

22%

ISO 27018

15 source controls mapped|4 target controls covered

16%

ISO/IEC 27018:2019

15 source controls mapped|4 target controls covered

16%

ISO 37301:2021

10 source controls mapped|10 target controls covered

11%

ISO 22000:2018

10 source controls mapped|10 target controls covered

11%

ISO 9001:2015

10 source controls mapped|10 target controls covered

11%

ISO 45001:2018

10 source controls mapped|10 target controls covered

11%

ISO 14001:2015

9 source controls mapped|9 target controls covered

10%

ISO/IEC 29100:2024

8 source controls mapped|2 target controls covered

ISO 37001:2016

8 source controls mapped|8 target controls covered

ISO 55001:2014

7 source controls mapped|7 target controls covered

ISO 50001:2018 - Energy Management Systems

7 source controls mapped|7 target controls covered

ISO 27018:2019

6 source controls mapped|6 target controls covered

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI)

3 source controls mapped|2 target controls covered

NIST SP 800-181

3 source controls mapped|6 target controls covered

CCSDS 350.0-G-3 - Space Communications Security (Consultative Committee for Space Data Systems)

3 source controls mapped|3 target controls covered

ISO/IEC 27011:2024

3 source controls mapped|3 target controls covered

ISO/IEC 27010:2015

3 source controls mapped|3 target controls covered

API 1164

3 source controls mapped|2 target controls covered

NIST SP 800-53A Rev. 5

2 source controls mapped|5 target controls covered

ISO 19011

2 source controls mapped|2 target controls covered

ISO 31000:2018

2 source controls mapped|2 target controls covered

ISO/IEC 25012:2008 - Data Quality Model

2 source controls mapped|4 target controls covered

Australian Energy Sector Cyber Security Framework (AESCSF)

2 source controls mapped|2 target controls covered

Protective Security Policy Framework (PSPF) Release 2024

2 source controls mapped|1 target controls covered

CISA Industrial Control Systems (ICS) Security Guidance

2 source controls mapped|1 target controls covered

C-TPAT - Customs-Trade Partnership Against Terrorism

2 source controls mapped|1 target controls covered

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements

2 source controls mapped|1 target controls covered

BRCGS Global Standard for Food Safety Issue 9

2 source controls mapped|1 target controls covered

EBA Guidelines on ICT and Security Risk Management (EBA/GL/2024/07)

2 source controls mapped|1 target controls covered

EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600)

2 source controls mapped|1 target controls covered

Digital Services Act (DSA) - Regulation (EU) 2022/2065