ISO 27002:2022

International

v2022

7 domains

104 controls

Information security, cybersecurity and privacy protection - Information security controls

Verified

ISO 27002:2022 is a compliance framework from International with 7 domains and 104 controls that map to 119 other frameworks. The largest domains are Organizational controls – ISO 27002:2022 (37 controls), Technological controls – ISO 27002:2022 (34 controls), Physical controls – ISO 27002:2022 (14 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (7)

Clause 0 – ISO 27002:2022

6 controls

Organizational controls – ISO 27002:2022

37 controls

Controls in the Organizational controls – ISO 27002:2022 domain of ISO 27002:2022 — 37 controls
Code	Title	Description
iso-27002-2022::5.1	Policies for information security	Requires an information security policy together with supporting topic specific policies. These must be defined, approve...
iso-27002-2022::5.10	Acceptable use of information and other associated assets	Requires rules for acceptable use, and procedures for handling information and its associated assets, to be identified,...
iso-27002-2022::5.11	Return of assets	Requires personnel and other relevant interested parties to return all organisational assets in their possession when em...
iso-27002-2022::5.12	Classification of information	Requires information to be classified according to the organisation's information security needs, judged on confidential...
iso-27002-2022::5.13	Labelling of information	Requires a matching set of information labelling procedures to be developed and implemented, so that information carries...
iso-27002-2022::5.14	Information transfer	Requires transfer rules, procedures or agreements to be in place for every type of transfer facility, covering transfers...
iso-27002-2022::5.15	Access control	Requires rules governing access to information and the assets tied to it, covering both physical entry and logical acces...
iso-27002-2022::5.16	Identity management	Requires the full life cycle of identities to be managed, from creation through change to removal.
iso-27002-2022::5.17	Authentication information	Requires a management process to control how authentication information is issued and looked after over time, including...
iso-27002-2022::5.18	Access rights	Requires access rights to information and other associated assets to be provisioned, reviewed, modified and removed in a...
iso-27002-2022::5.19	Information security in supplier relationships	Requires processes and procedures to be defined and implemented for managing the information security risks that arise f...
iso-27002-2022::5.2	Information security roles and responsibilities	Requires information security roles and responsibilities to be defined and allocated in line with what the organisation...
iso-27002-2022::5.20	Addressing information security within supplier agreements	Requires the relevant information security requirements to be established and agreed with each supplier, scaled to the t...
iso-27002-2022::5.21	Managing information security in the ICT supply chain	Requires processes and procedures to be defined and implemented to manage information security risk arising along the su...
iso-27002-2022::5.22	Monitoring, review and change management of supplier services	Requires supplier information security practice and service delivery to be monitored, reviewed and evaluated on a regula...
iso-27002-2022::5.23	Information security for use of cloud services	Requires processes for the acquisition, use, management and exit of cloud services to be established in line with the or...
iso-27002-2022::5.24	Information security incident management planning and preparation	Requires the organisation to plan and prepare for incident handling ahead of time. Incident management processes, plus t...
iso-27002-2022::5.25	Assessment and decision on information security events	Requires information security events to be assessed and a decision taken on whether each event is to be categorised as a...
iso-27002-2022::5.26	Response to information security incidents	Requires information security incidents to be responded to in accordance with documented procedures, rather than improvi...
iso-27002-2022::5.27	Learning from information security incidents	Requires knowledge gained from information security incidents to be fed back into strengthening and improving the inform...
iso-27002-2022::5.28	Collection of evidence	Requires procedures to be established and used for identifying evidence relating to information security events, then co...
iso-27002-2022::5.29	Information security during disruption	Requires the organisation to plan how information security will be maintained at an appropriate level while a disruption...
iso-27002-2022::5.3	Segregation of duties	Requires duties and areas of responsibility that would conflict if held by one person to be separated, limiting the scop...
iso-27002-2022::5.30	ICT readiness for business continuity	Requires ICT readiness to be planned, implemented, maintained and tested against business continuity objectives and ICT...
iso-27002-2022::5.31	Legal, statutory, regulatory and contractual requirements	Requires the legal, statutory, regulatory and contractual requirements bearing on information security, and the organisa...
iso-27002-2022::5.32	Intellectual property rights	Requires appropriate procedures to be implemented to protect intellectual property rights.
iso-27002-2022::5.33	Protection of records	Requires records to be protected against loss, destruction, falsification, unauthorised access and unauthorised release.
iso-27002-2022::5.34	Privacy and protection of PII	Requires the requirements for preserving privacy and protecting personally identifiable information to be identified and...
iso-27002-2022::5.35	Independent review of information security	Requires the organisation's approach to managing information security, and its implementation across people, processes a...
iso-27002-2022::5.36	Compliance with policies, rules and standards for information security	Requires compliance with the organisation's own information security policy, topic specific policies, rules and standard...
iso-27002-2022::5.37	Documented operating procedures	Requires the operating procedures used to run information processing facilities to be written down and made available to...
iso-27002-2022::5.4	Management responsibilities	Requires management to compel all personnel to apply information security in accordance with the organisation's establis...
iso-27002-2022::5.5	Contact with authorities	Requires the organisation to establish and maintain working contact with the relevant authorities, so that security matt...
iso-27002-2022::5.6	Contact with special interest groups	Requires ongoing contact to be maintained with special interest groups, with forums that specialise in security and with...
iso-27002-2022::5.7	Threat intelligence	Requires information about information security threats to be collected and analysed so that it becomes usable threat in...
iso-27002-2022::5.8	Information security in project management	Requires information security to be integrated into the way projects are managed, so security is handled inside the proj...
iso-27002-2022::5.9	Inventory of information and other associated assets	Requires an inventory of information and of the other assets associated with it to be developed and kept current, and re...

People controls – ISO 27002:2022

8 controls

Controls in the People controls – ISO 27002:2022 domain of ISO 27002:2022 — 8 controls
Code	Title	Description
iso-27002-2022::6.1	Screening	Requires background verification checks on all candidates for personnel before they join and on an ongoing basis afterwa...
iso-27002-2022::6.2	Terms and conditions of employment	Requires employment contractual agreements to state what the individual and the organisation are each responsible for wi...
iso-27002-2022::6.3	Information security awareness, education and training	Requires personnel and relevant interested parties to receive appropriate information security awareness, education and...
iso-27002-2022::6.4	Disciplinary process	Requires a formalised disciplinary process, communicated in advance, so that action can be taken where personnel or othe...
iso-27002-2022::6.5	Responsibilities after termination or change of employment	Requires the security duties and responsibilities that survive the end of employment, or a move to a different role, to...
iso-27002-2022::6.6	Confidentiality or non-disclosure agreements	Requires confidentiality or non-disclosure agreements matching the organisation's need to protect information to be iden...
iso-27002-2022::6.7	Remote working	Requires security measures to be implemented when personnel work remotely, protecting information that is accessed, proc...
iso-27002-2022::6.8	Information security event reporting	Requires a mechanism through which personnel can report security events they have observed or suspect, using appropriate...

Physical controls – ISO 27002:2022

14 controls

Controls in the Physical controls – ISO 27002:2022 domain of ISO 27002:2022 — 14 controls
Code	Title	Description
iso-27002-2022::7.1	Physical security perimeters	Requires security perimeters to be defined and used to protect any area holding information and the assets associated wi...
iso-27002-2022::7.10	Storage media	Requires storage media to be managed across their whole life cycle, covering acquisition, use, transportation and dispos...
iso-27002-2022::7.11	Supporting utilities	Requires information processing facilities to be shielded from power loss and from other disruption arising when support...
iso-27002-2022::7.12	Cabling security	Requires cables carrying power, data or supporting information services to be protected from interception, interference...
iso-27002-2022::7.13	Equipment maintenance	Requires equipment to be maintained correctly, so that information stays available, intact and confidential.
iso-27002-2022::7.14	Secure disposal or re-use of equipment	Requires items of equipment containing storage media to be verified before disposal or re-use, confirming that sensitive...
iso-27002-2022::7.2	Physical entry	Requires secure areas to be protected by appropriate entry controls and by control over the access points themselves.
iso-27002-2022::7.3	Securing offices, rooms and facilities	Requires physical security for offices, rooms and facilities to be designed and then actually implemented.
iso-27002-2022::7.4	Physical security monitoring	Requires premises to be monitored continuously for unauthorised physical access. Supporting material frames this as cont...
iso-27002-2022::7.5	Protecting against physical and environmental threats	Requires designed and implemented protection against physical and environmental threats. These include natural disasters...
iso-27002-2022::7.6	Working in secure areas	Requires security measures governing how people work inside secure areas to be designed and implemented.
iso-27002-2022::7.7	Clear desk and clear screen	Requires defined and enforced rules for clearing papers and removable storage media from desks, and for clearing the scr...
iso-27002-2022::7.8	Equipment siting and protection	Requires equipment to be sited securely and protected. Older source material in the folder expands this as siting equipm...
iso-27002-2022::7.9	Security of assets off-premises	Requires assets located away from the organisation's premises to be protected.

Structure of this document – ISO 27002:2022

3 controls

Technological controls – ISO 27002:2022

34 controls

Controls in the Technological controls – ISO 27002:2022 domain of ISO 27002:2022 — 34 controls
Code	Title	Description
iso-27002-2022::8.1	User endpoint devices	Requires information stored on, processed by or accessible through user endpoint devices to be protected.
iso-27002-2022::8.10	Information deletion	Requires information held in information systems, devices or any other storage media to be deleted once it is no longer...
iso-27002-2022::8.11	Data masking	Requires data masking to be used in accordance with the topic specific policy on access control, other related topic spe...
iso-27002-2022::8.12	Data leakage prevention	Requires data leakage prevention measures across systems, networks and any other device that processes, stores or transm...
iso-27002-2022::8.13	Information backup	Requires backup copies of information, software and systems to be maintained and regularly tested, in line with the agre...
iso-27002-2022::8.14	Redundancy of information processing facilities	Requires information processing facilities to be implemented with redundancy sufficient to meet the availability require...
iso-27002-2022::8.15	Logging	Requires logs to be produced, stored, protected and analysed, covering activities, exceptions, faults and any other even...
iso-27002-2022::8.16	Monitoring activities	Requires networks, systems and applications to be monitored for anomalous behaviour, with appropriate action taken to ev...
iso-27002-2022::8.17	Clock synchronization	Requires the clocks of the information processing systems the organisation uses to be synchronised to approved time sour...
iso-27002-2022::8.18	Use of privileged utility programs	Requires the use of utility programs capable of overriding system and application controls to be restricted and tightly...
iso-27002-2022::8.19	Installation of software on operational systems	Requires procedures and measures to be implemented to manage software installation on operational systems securely. Seco...
iso-27002-2022::8.2	Privileged access rights	Requires the allocation and use of privileged access rights to be restricted and actively managed.
iso-27002-2022::8.20	Networks security	Requires networks and network devices to be secured, managed and controlled in order to protect the information carried...
iso-27002-2022::8.21	Security of network services	Requires the security mechanisms for network services, along with their service levels and the requirements placed on th...
iso-27002-2022::8.22	Segregation of networks	Requires segregation within the organisation's networks, keeping groups of information services, of users and of systems...
iso-27002-2022::8.23	Web filtering	Requires access to external websites to be managed so as to reduce exposure to malicious content.
iso-27002-2022::8.24	Use of cryptography	Requires defined and implemented rules on using cryptography effectively, including how cryptographic keys are managed.
iso-27002-2022::8.25	Secure development life cycle	Requires rules covering the secure development of both software and systems to be established and applied.
iso-27002-2022::8.26	Application security requirements	Requires information security requirements to be identified, specified and approved when applications are being develope...
iso-27002-2022::8.27	Secure system architecture and engineering principles	Requires principles for engineering secure systems to be established, documented and maintained, then applied across all...
iso-27002-2022::8.28	Secure coding	Requires secure coding principles to be applied to software development.
iso-27002-2022::8.29	Security testing in development and acceptance	Requires security testing processes to be defined and implemented within the development life cycle.
iso-27002-2022::8.3	Information access restriction	Requires access to information and other associated assets to be restricted in accordance with the established topic spe...
iso-27002-2022::8.30	Outsourced development	Requires the organisation to direct, monitor and review the activities involved in outsourced system development. Second...
iso-27002-2022::8.31	Separation of development, test and production environments	Requires development, testing and production environments to be separated from one another and each of them secured.
iso-27002-2022::8.32	Change management	Requires change management procedures to govern changes made to information systems and to the facilities that process i...
iso-27002-2022::8.33	Test information	Requires test information to be appropriately selected, protected and managed.
iso-27002-2022::8.34	Protection of information systems during audit testing	Requires audit tests and other assurance activities that assess operational systems to be planned and agreed in advance...
iso-27002-2022::8.4	Access to source code	Requires managed control over who can read and who can write to source code, and equally over development tools and soft...
iso-27002-2022::8.5	Secure authentication	Requires secure authentication technologies and procedures to be implemented, driven by the information access restricti...
iso-27002-2022::8.6	Capacity management	Requires resource consumption to be monitored, and capacity to be adjusted so it matches both current demand and what is...
iso-27002-2022::8.7	Protection against malware	Requires malware protection to be put in place and reinforced by suitable awareness among users.
iso-27002-2022::8.8	Management of technical vulnerabilities	Requires information about technical vulnerabilities in the information systems in use to be obtained, the organisation'...
iso-27002-2022::8.9	Configuration management	Requires configurations of hardware, software, services and networks, including their security configurations, to be est...

Terms, definitions and abbreviated terms – ISO 27002:2022

2 controls

Your Compliance Coverage

If you comply with ISO 27002:2022, you already cover:

SOC 2

100%

93 controls mapped

Compare →

NIST SP 800-53 Rev 5

100%

93 controls mapped

Compare →

ISO 27001:2022

99%

92 controls mapped

Compare →

+ 116 more: C5 (Germany) (97%), FedRAMP High (97%)

See all 119 mapped frameworks ↓

Maps to 119 other frameworks

93 total controls

SOC 2

93 source controls mapped|59 target controls covered

100%

NIST SP 800-53 Rev 5

93 source controls mapped|262 target controls covered

100%

ISO 27001:2022

92 source controls mapped|92 target controls covered

99%

C5 (Germany)

90 source controls mapped|116 target controls covered

97%

FedRAMP High

90 source controls mapped|319 target controls covered

97%

FedRAMP Moderate

90 source controls mapped|318 target controls covered

97%

NIST SP 800-53 Revision 5.1 HIGH

90 source controls mapped|237 target controls covered

97%

NIST SP 800-53 Rev 5 MODERATE

90 source controls mapped|233 target controls covered

97%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

90 source controls mapped|180 target controls covered

97%

NIST Cybersecurity Framework 2.0

88 source controls mapped|103 target controls covered

95%

NIST SP 800-53 Rev 5 LOW

86 source controls mapped|132 target controls covered

92%

PCI DSS 4.0

85 source controls mapped|247 target controls covered

91%

Australian Information Security Manual

81 source controls mapped|235 target controls covered

87%

NIST SP 800-161 Rev 1

77 source controls mapped|96 target controls covered

83%

ISO 27701:2019

75 source controls mapped|96 target controls covered

81%

CIS Controls v8

74 source controls mapped|150 target controls covered

80%

NIST SP 800-171 Rev 3

72 source controls mapped|79 target controls covered

77%

CMMC 2.0

71 source controls mapped|107 target controls covered

76%

HIPAA Security Rule

70 source controls mapped|66 target controls covered

75%

NIST SP 800-66 Rev 2

66 source controls mapped|55 target controls covered

71%

NIS2 Directive

63 source controls mapped|26 target controls covered

68%

Azure Security Benchmark

60 source controls mapped|85 target controls covered

65%

CFTC System Safeguards (17 CFR 37, 38, 39, 49)

59 source controls mapped|23 target controls covered

63%

AWS Well-Architected Security Pillar

57 source controls mapped|63 target controls covered

61%

Australia Consumer Data Right - Banking (CDR)

54 source controls mapped|15 target controls covered

58%

DORA

53 source controls mapped|25 target controls covered

57%

ANSSI Guide d'hygiene informatique (42 mesures, v2.0)

49 source controls mapped|41 target controls covered

53%

NIST SP 800-172

48 source controls mapped|31 target controls covered

52%

ASD Strategies to Mitigate Cyber Security Incidents

36 source controls mapped|37 target controls covered

39%

ISO 22301:2019

32 source controls mapped|51 target controls covered

34%

Australia My Health Records Act 2012

32 source controls mapped|21 target controls covered

34%

ACSC Essential Eight

31 source controls mapped|20 target controls covered

33%

ISO/IEC 42001:2023

29 source controls mapped|32 target controls covered

31%

NIST SP 800-218

29 source controls mapped|42 target controls covered

31%

APRA CPS 230 Operational Risk Management

28 source controls mapped|37 target controls covered

30%

ISO 27018:2019

28 source controls mapped|31 target controls covered

30%

GDPR

27 source controls mapped|12 target controls covered

29%

APRA CPS 234

26 source controls mapped|24 target controls covered

28%

UK Cyber Essentials

21 source controls mapped|31 target controls covered

23%

Authorised Economic Operator (AEO) Programmes - Global Standards

20 source controls mapped|11 target controls covered

22%

ISO/IEC 27011:2024

16 source controls mapped|16 target controls covered

17%

ISO 27018

12 source controls mapped|4 target controls covered

13%

ISO/IEC 27018:2019

12 source controls mapped|4 target controls covered

13%

APPI

12 source controls mapped|16 target controls covered

13%

ISO 19011:2018

11 source controls mapped|13 target controls covered

12%

ISO 27017:2015

6 source controls mapped|5 target controls covered

ISO/IEC 38500:2024

6 source controls mapped|4 target controls covered

ISO/IEC 29100:2024

5 source controls mapped|2 target controls covered

ISO 27043

4 source controls mapped|3 target controls covered

ISO/SAE 21434

4 source controls mapped|3 target controls covered

Annex 11 to EU GMP - Computerised Systems

4 source controls mapped|2 target controls covered

API 1164

4 source controls mapped|4 target controls covered

Australian Energy Sector Cyber Security Framework (AESCSF)

3 source controls mapped|3 target controls covered

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI)

3 source controls mapped|2 target controls covered

NIST SP 800-181

3 source controls mapped|6 target controls covered

EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600)

3 source controls mapped|2 target controls covered

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements

3 source controls mapped|2 target controls covered

EBA Guidelines on ICT and Security Risk Management (EBA/GL/2024/07)

3 source controls mapped|2 target controls covered

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration Laboratories

3 source controls mapped|2 target controls covered

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration

3 source controls mapped|4 target controls covered

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence

3 source controls mapped|3 target controls covered

PCI SSF

3 source controls mapped|3 target controls covered

ISO 27019

3 source controls mapped|4 target controls covered

NIST SP 800-53A Rev. 5

2 source controls mapped|5 target controls covered

ISO/IEC 27010:2015

2 source controls mapped|2 target controls covered

ISO/IEC 27701:2019

2 source controls mapped|2 target controls covered

SOC 1 (SSAE 18 / ISAE 3402)

2 source controls mapped|3 target controls covered

FFIEC IT Examination Handbook

2 source controls mapped|2 target controls covered

CCSDS 350.0-G-3 - Space Communications Security (Consultative Committee for Space Data Systems)

2 source controls mapped|2 target controls covered

Taiwan PDPA

2 source controls mapped|1 target controls covered

C-TPAT - Customs-Trade Partnership Against Terrorism

2 source controls mapped|1 target controls covered

BRCGS Global Standard for Food Safety Issue 9

2 source controls mapped|1 target controls covered

CISA Industrial Control Systems (ICS) Security Guidance

2 source controls mapped|1 target controls covered

Protective Security Policy Framework (PSPF) Release 2024

2 source controls mapped|1 target controls covered

IEC 62443

2 source controls mapped|2 target controls covered

ITIL 4

2 source controls mapped|2 target controls covered

ISO 20000-1

2 source controls mapped|2 target controls covered

NIST SP 1800-32

2 source controls mapped|2 target controls covered

AICPA SOC 3

2 source controls mapped|2 target controls covered

ISO 26262:2018 - Functional Safety for Road Vehicles

2 source controls mapped|2 target controls covered

NY DFS 23 NYCRR 500

2 source controls mapped|2 target controls covered

COSO Internal Control - Integrated Framework (2013)

1 source controls mapped|1 target controls covered

NIST SP 800-207

1 source controls mapped|2 target controls covered

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework

1 source controls mapped|1 target controls covered

Equator Principles (EP4, 2020)

1 source controls mapped|1 target controls covered

AML/CTF Act 2006 (Australia)

1 source controls mapped|1 target controls covered

ISO/IEC TR 24028:2020

1 source controls mapped|1 target controls covered

ISO 10005:2005

1 source controls mapped|1 target controls covered

EDM Council CDMC - Cloud Data Management Capability Framework

1 source controls mapped|1 target controls covered

SANS Incident Handler's Handbook and PICERL Methodology

1 source controls mapped|1 target controls covered

CMMC 2.0 Level 1

1 source controls mapped|1 target controls covered

AICPA Privacy Management Framework (PMF)

1 source controls mapped|1 target controls covered

Cambodia Sub-Decree on Personal Data Protection (Sub-Decree No. 134)

1 source controls mapped|1 target controls covered

ISO 55001:2014

1 source controls mapped|1 target controls covered

ISO 45001:2018

1 source controls mapped|2 target controls covered

ISO 55001

1 source controls mapped|1 target controls covered

ISO 45001

1 source controls mapped|1 target controls covered

Botswana Data Protection Act (2024)

1 source controls mapped|1 target controls covered

Bermuda Personal Information Protection Act 2016 (PIPA)

1 source controls mapped|1 target controls covered

CNCF Security Technical Advisory Group (TAG)

1 source controls mapped|1 target controls covered

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)

1 source controls mapped|1 target controls covered

ISO 10007:2017

1 source controls mapped|1 target controls covered

NIST SP 800-160

1 source controls mapped|2 target controls covered

NATO AQAP 2110 - Quality Assurance Requirements for Design, Development, and Production

1 source controls mapped|1 target controls covered

FBI CJIS Security Policy

1 source controls mapped|2 target controls covered

NIST SP 800-128

1 source controls mapped|2 target controls covered

Canada ITSG-33 - IT Security Risk Management

1 source controls mapped|1 target controls covered

AS9100D:2016 - Quality Management Systems for Aviation, Space, and Defence

1 source controls mapped|1 target controls covered

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

1 source controls mapped|1 target controls covered

ASIC Cyber Resilience Good Practices

1 source controls mapped|1 target controls covered

Automotive SPICE (ASPICE) v4.0 - Process Assessment Model

1 source controls mapped|1 target controls covered

Bermuda Monetary Authority (BMA) Cyber Risk Management Code of Conduct

1 source controls mapped|1 target controls covered

SSAE 18 - Attestation Standards (SOC Reporting)

1 source controls mapped|1 target controls covered

ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3)

1 source controls mapped|1 target controls covered

Australia NHMRC National Statement on Ethical Conduct in Human Research

1 source controls mapped|1 target controls covered

ISO 19011

1 source controls mapped|2 target controls covered

ISO 31000:2018

1 source controls mapped|2 target controls covered

ISO/IEC 25012:2008 - Data Quality Model

1 source controls mapped|2 target controls covered

Digital Services Act (DSA) - Regulation (EU) 2022/2065

1 source controls mapped|1 target controls covered

Compare ISO 27002:2022 with SOC 2

What is ISO 27002:2022 and who does it apply to?

ISO 27002:2022 is a compliance framework from International with 7 domains and 104 controls. Information security, cybersecurity and privacy protection - Information security controls It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does ISO 27002:2022 actually require?

ISO 27002:2022 has 104 controls organised across 7 domains. The largest domains are Organizational controls – ISO 27002:2022 (37 controls), Technological controls – ISO 27002:2022 (34 controls), Physical controls – ISO 27002:2022 (14 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of ISO 27002:2022 do I already cover?

ISO 27002:2022 maps to 119 other compliance frameworks. The top mapping partners are SOC 2 (100% coverage), NIST SP 800-53 Rev 5 (100% coverage), ISO 27001:2022 (99% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement ISO 27002:2022?

Start your ISO 27002:2022 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO 27002:2022 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 104 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required