The control record
All 93 controls and their five attributes
The complete ISO/IEC 27002:2022 catalogue in four themes, each control with its published control type, cybersecurity concept count and security domains. Every row opens a page with the requirement in our own words, all five attribute values, the evidence and the common gaps.
01The index
Organizational controls 37
People controls 8
| Code | Control | Control type | Concepts | Security domains |
|---|---|---|---|---|
| 6.1 | Screening | Preventive | 1 | Governance and ecosystem |
| 6.2 | Terms and conditions of employment | Preventive | 1 | Governance and ecosystem |
| 6.3 | Information security awareness, education and training | Preventive | 1 | Governance and ecosystem |
| 6.4 | Disciplinary process | Preventive / Corrective | 2 | Governance and ecosystem |
| 6.5 | Responsibilities after termination or change of employment | Preventive | 1 | Governance and ecosystem |
| 6.6 | Confidentiality or non-disclosure agreements | Preventive | 1 | Governance and ecosystem |
| 6.7 | Remote working | Preventive | 1 | Protection |
| 6.8 | Information security event reporting | Detective | 1 | Defence |
Physical controls 14
| Code | Control | Control type | Concepts | Security domains |
|---|---|---|---|---|
| 7.1 | Physical security perimeters | Preventive | 1 | Protection |
| 7.10 | Storage media | Preventive | 1 | Protection |
| 7.11 | Supporting utilities | Preventive / Detective | 2 | Protection |
| 7.12 | Cabling security | Preventive | 1 | Protection |
| 7.13 | Equipment maintenance | Preventive | 1 | Protection / Resilience |
| 7.14 | Secure disposal or re-use of equipment | Preventive | 1 | Protection |
| 7.2 | Physical entry | Preventive | 1 | Protection |
| 7.3 | Securing offices, rooms and facilities | Preventive | 1 | Protection |
| 7.4 | Physical security monitoring | Preventive / Detective | 2 | Protection / Defence |
| 7.5 | Protecting against physical and environmental threats | Preventive | 1 | Protection |
| 7.6 | Working in secure areas | Preventive | 1 | Protection |
| 7.7 | Clear desk and clear screen | Preventive | 1 | Protection |
| 7.8 | Equipment siting and protection | Preventive | 1 | Protection |
| 7.9 | Security of assets off-premises | Preventive | 1 | Protection |
Technological controls 34
| Code | Control | Control type | Concepts | Security domains |
|---|---|---|---|---|
| 8.1 | User endpoint devices | Preventive | 1 | Protection |
| 8.10 | Information deletion | Preventive | 1 | Protection |
| 8.11 | Data masking | Preventive | 1 | Protection |
| 8.12 | Data leakage prevention | Preventive / Detective | 2 | Protection / Defence |
| 8.13 | Information backup | Corrective | 1 | Protection |
| 8.14 | Redundancy of information processing facilities | Preventive | 1 | Protection / Resilience |
| 8.15 | Logging | Detective | 1 | Protection / Defence |
| 8.16 | Monitoring activities | Detective / Corrective | 2 | Defence |
| 8.17 | Clock synchronization | Detective | 2 | Protection / Defence |
| 8.18 | Use of privileged utility programs | Preventive | 1 | Protection |
| 8.19 | Installation of software on operational systems | Preventive | 1 | Protection |
| 8.2 | Privileged access rights | Preventive | 1 | Protection |
| 8.20 | Networks security | Preventive / Detective | 2 | Protection |
| 8.21 | Security of network services | Preventive | 1 | Protection |
| 8.22 | Segregation of networks | Preventive | 1 | Protection |
| 8.23 | Web filtering | Preventive | 1 | Protection |
| 8.24 | Use of cryptography | Preventive | 1 | Protection |
| 8.25 | Secure development life cycle | Preventive | 1 | Protection |
| 8.26 | Application security requirements | Preventive | 1 | Protection / Defence |
| 8.27 | Secure system architecture and engineering principles | Preventive | 1 | Protection |
| 8.28 | Secure coding | Preventive | 1 | Protection |
| 8.29 | Security testing in development and acceptance | Preventive | 1 | Protection |
| 8.3 | Information access restriction | Preventive | 1 | Protection |
| 8.30 | Outsourced development | Preventive / Detective | 3 | Governance and ecosystem / Protection |
| 8.31 | Separation of development, test and production environments | Preventive | 1 | Protection |
| 8.32 | Change management | Preventive | 1 | Protection |
| 8.33 | Test information | Preventive | 1 | Protection |
| 8.34 | Protection of information systems during audit testing | Preventive | 1 | Governance and ecosystem / Protection |
| 8.4 | Access to source code | Preventive | 1 | Protection |
| 8.5 | Secure authentication | Preventive | 1 | Protection |
| 8.6 | Capacity management | Preventive / Detective | 3 | Governance and ecosystem / Protection |
| 8.7 | Protection against malware | Preventive / Detective / Corrective | 2 | Protection / Defence |
| 8.8 | Management of technical vulnerabilities | Preventive | 2 | Governance and ecosystem / Protection / Defence |
| 8.9 | Configuration management | Preventive | 1 | Protection |
The code is the ISO/IEC 27002:2022 identifier. A control can carry more than one value in any attribute; the table shows the control type and the count of concepts, and the control page shows the full set.
02The attributes
How to read a row
Control type answers when the control acts. The concept count shows how many of identify, protect, detect, respond and recover the control serves. The security domains show the broad audience view. The control page adds the information security properties, the operational capabilities and the evidence.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.