ISO/IEC 27002:2022
ISO 27002
Not a certificate. The catalogue of controls that ISO 27001 certifies against, with the guidance on how each one is meant to work. Most readings from your tools land on an ISO 27002 control first; every other framework in the catalog maps to it.
Do you need it?
If you need ISO 27001 you are already using it. On its own, it is the best control list there is.
Yes
You hold or pursue ISO 27001.
Annex A of 27001 is this list. The guidance on how to implement each control, which the auditor expects you to have read, is here.
Yes
You want one control list to run security by.
Ninety-three controls that most customers, auditors and regulators recognise. NIS2, DORA and SOC 2 all map onto them, so evidence collected once serves all of them.
Not this one
You want a certificate.
ISO 27002 is guidance and cannot be certified against. The certificate is ISO 27001; this page is what it audits.
What the standard holds
Theme 5
Organisational controls
Policies, roles, asset management, access control, supplier relationships, incident management, continuity and compliance. Thirty-seven controls, most of them evidenced by documents and acknowledgements.
Theme 6
People controls
Screening, terms of employment, awareness and training, disciplinary process, duties after termination. Eight controls that live in your HR and identity tools.
Theme 7
Physical controls
Perimeters, entry, offices, equipment, cabling, disposal. Fourteen controls; for an online business running on clouds, most are inherited from the providers and evidenced by their reports.
Theme 8
Technological controls
Endpoints, access rights, authentication, backups, logging, network security, cryptography, secure development. Thirty-four controls, and the ones your tools can prove on their own.
The edition
One edition, restructured in 2022, with attributes on every control. The standard at ISO.
- 15 February 2022ISO/IEC 27002:2022 published: 93 controls in four themes replace 114 controls in 14 domains, with 11 new ones such as threat intelligence, cloud services and data leakage prevention.
- AttributesEvery control carries attributes: control type, security property, cybersecurity concept, operational capability and security domain, so one list can be read from several angles.
- 31 October 2025Transition of ISO 27001 certificates to the 2022 control set ended; audits reference these numbers.
How the evidence lands
Technological controls from your tools
Two-factor, access rights, backups, encryption, logging and secure configuration, read on a schedule from the tools and clouds you connect and filed on the control they prove.
Organisational controls from policies
Policies adopted from the catalog, published to your people, with every acknowledgement kept. Supplier controls 5.19 to 5.23 from the vendor graph.
Inherited controls
Physical and some technological controls are the cloud provider's. Their reports and certificates sit on the vendor record, linked to the control they cover.
Gaps you can see
Every control shows what evidences it today and what still needs a document or a manual check, so the Statement of Applicability is written from the facts.
See which ISO 27002 controls your tools already prove
Thirty minutes. We connect one of your integrations live and show the first readings landing on your controls.