Annex B (informative) Correspondence of ISO/IEC 27002:2022 with ISO/IEC 27002:2013

What this part of the catalogue does

Annex B gives backwards compatibility for organizations moving from the 2013 edition: Table B.1 maps each of the 93 controls of this edition to the 2013 control or controls it derives from (11 are new: threat intelligence in 5.7, cloud services in 5.23, ICT readiness in 5.30, physical security monitoring in 7.4, configuration management in 8.9, information deletion in 8.10, data masking in 8.11, data leakage prevention in 8.12, monitoring activities in 8.16, web filtering in 8.23 and secure coding in 8.28), and Table B.2 maps each 2013 control to its place in this edition. The Table B.1 references are carried on each control node as iso27002_2013_refs.

What it means when you fill the register

Annex B is informative and gives the correspondence between this edition and the 2013 edition: which controls were merged, renamed, added or dropped. It is the migration aid, not a requirement. For the attribute work it explains why some codes look unfamiliar and why a 2013 control may map to a 2022 control that carries different attributes. Our pages use the correspondence only to help a reader find the same control under the older numbering, and the register keeps the 2013 reference in its own column. A mapping is not an equivalence: two controls can share a 2013 ancestor and still differ in type, property and domain, and the attribute columns are where that difference becomes visible.

Annex B answers 'where did my old control go?'. A team migrating a register from the earlier edition needs the correspondence to find the row, and then needs the attributes to see whether the new control behaves like the old one. A mapping that stops at the code hides a change in type, property or domain. In practice the register keeps the old reference in a column and the new values beside it, so a reader can compare without opening two documents.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method