Information security, cybersecurity
and privacy protection — Information
security controls
Sécurité de l'information, cybersécurité et protection de la vie
privée — Mesures de sécurité de l'information
INTERNATIONAL
STANDARD
ISO/IEC
27002
Third edition
2022-02
Reference number
ISO/IEC 27002:2022(E)
© ISO/IEC 2022
ii
ISO/IEC 27002:2022(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2022
Website: www.iso.org
© ISO/IEC 2022 – All rights reserved
ISO/IEC 27002:2022(E)
Foreword ....................................................................................................................................................................................................................................... vi
Introduction
.............................................................................................................................................................................................................................vii
1 Scope ................................................................................................................................................................................................................................. 1
2 Normative references ..................................................................................................................................................................................... 1
.............................................................................................................................. 1
......................................................................................................................................................................
.............................................................................................................................................................................. 6
4 Structure of this document ....................................................................................................................................................................... 7
........................................................................................................................................................................................................... 7
....................................................................................................................................................................
..........................................................................................................................................................................................
5 Organizational controls ............................................................................................................................................................................... 9
........................................................................................................................................... .
....................................................................................................
......................................................................................................................................................................
.................................................................................................................................................
.............................................................................................................................................................
...............................................................................................................................
...........................................................................................................................................................................
.........................................................................................................
....................................................................................
....................................................................... 20
..................................................................................................................................................................................
................................................................................................................................................... 22
............................................................................................................................................................. 23
......................................................................................................................................................................
....................................................................................................................................................................................... 27
.....................................................................................................................................................................
..................................................................................................................................................... 30
.......................................................................................................................................................................................... 32
...................................................................................................... 33
............................................................... 35
................................................................................ 37
......................................................
.......................................................................................................
..........................................
...........................................................................
.............................................................................................................
.......................................................................................................
....................................................................................................................................................................
.......................................................................................................................
............................................................................................................................
....................................................................... 50
.....................................................................................................................................................
..................................................................................................................................................................... 53
..................................................................................................................................................
........................................................................................................... 55
...................................... 56
.................................................................................................................................. 57
6 People controls ...................................................................................................................................................................................................58
..................................................................................................................................................................................................
.............................................................................................................................
iii
© ISO/IEC 2022 – All rights reserved
Contents
ISO/IEC 27002:2022(E)
............................................................................ 60
....................................................................................................................................................................... 62
................................................................... 63
....................................................................................................... 63
6.7 Remote working ................................................................................................................................................................................. 65
............................................................................................................................. 66
7 Physical controls ............................................................................................................................................................................................... 67
.................................................................................................................................................. 67
.......................................................................................................................................................................................
............................................................................................................................. 70
.................................................................................................................................................. 70
...............................................................................
............................................................................................................................................................. 72
...................................................................................................................................................... 73
.........................................................................................................................................
............................................................................................................................................. 75
....................................................................................................................................................................................... 76
.......................................................................................................................................................................... 77
..................................................................................................................................................................................
.............................................................................................................................................................
........................................................................................................................
8 Technological controls ...............................................................................................................................................................................81
...................................................................................................................................................................
...............................................................................................................................................................
..............................................................................................................................................
....................................................................................................................................................................
...................................................................................................................................................................
...................................................................................................................................................................
....................................................................................................................................................
.....................................................................................................................
.....................................................................................................................................................
......................................................................................................................................................................
........................................................................................................................................................................................
..........................................................................................................................................................
......................................................................................................................................................................
..............................................................................................
....................................................................................................................................................................................................
........................................................................................................................................... ........................
...............................................................................................................................................................
..................................................................................................................................
...............................................................................................
.........................................................................................................................................................................
...............................................................................................................................................
..........................................................................................................................................................
.......................................................................................................................................................................................
....................................................................................................................................................................
.............................................................................................................................................
................................................................................................................................
............................................................................
.....................................................................................................................................................................................
..............................................................................................
........................................................................................................................................................
..........................................................
...................................................................................................................................................................
..............................................................................................................................................................................
............................................................................
Annex A Using attributes .................................................................................................................................................... 132
iv
© ISO/IEC 2022 – All rights reserved
ISO/IEC 27002:2022(E)
Annex B Correspondence of ISO/IEC 27002:2022 (this document) with ISO/
IEC 27002:2013 ............................................................................................................................................................................................... 143
Bibliography
......................................................................................................................................................................................................................... 150
v
© ISO/IEC 2022 – All rights reserved