# Index to the original texts of ISO 27002
2022 version

| 2022 ID | Control title                                                                                                                                                               | 2013                           |
| ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
| **F**   | **[[ISO_27002_OT_F Foreword            \|Foreword]]**                                                                                                                       |                                |
| **0**   | **[[ISO_27002_OT_0 Introduction        \|Introduction]]**                                                                                                                   |                                |
| **1**   | **[[ISO_27002_OT_1 Scope               \|Scope]]**                                                                                                                          |                                |
| **2**   | **[[ISO_27002_OT_2 Normative references\|Normative references]]**                                                                                                           |                                |
| **3**   | **Terms, definitions and abbreviated terms**                                                                                                                                |                                |
| 3.1     | **[[ISO_27002_OT_3.1 Terms and definitions\|Terms and definitions]]**                                                                                                       |                                |
| 3.2     | **[[ISO_27002_OT_3.2 Abbreviated terms\|Abbreviated terms]]**                                                                                                               |                                |
| **4**   | **Structure of this document**                                                                                                                                              |                                |
| 4.1     | [[ISO_27002_OT_4.1 Clauses                                                                       \| Clauses                                                              ]] |                                |
| 4.2     | [[ISO_27002_OT_4.2 Themes and attributes                                                         \| Themes and attributes                                                ]] |                                |
| 4.3     | [[ISO_27002_OT_4.3 Control layout                                                                \| Control layout                                                       ]] |                                |
| **5**   | **Organizational controls**                                                                                                                                                 |                                |
| 5.1     | [Policies for information security                                     ](27002/EN/a-5.1-Policies-for-information-security.md)  | 05.1.1, 05.1.2                 |
| 5.2     | [Information security roles and responsibilities                       ](27002/EN/a-5.2-Information-security-roles-and-responsibilities.md)  | 06.1.1                         |
| 5.3     | [Segregation of duties                                                 ](27002/EN/a-5.3-Segregation-of-duties.md)  | 06.1.2                         |
| 5.4     | [Management responsibilities                                           ](27002/EN/a-5.4-Management-responsibilities.md)  | 07.2.1                         |
| 5.5     | [Contact with authorities                                              ](27002/EN/a-5.5-Contact-with-authorities.md)  | 06.1.3                         |
| 5.6     | [Contact with special interest groups                                  ](27002/EN/a-5.6-Contact-with-special-interest-groups.md)  | 06.1.4                         |
| 5.7     | [Threat intelligence                                                   ](27002/EN/a-5.7-Threat-intelligence.md)  | New                            |
| 5.8     | [Information security in project management                            ](27002/EN/a-5.8-Information-security-in-project-management.md)  | 06.1.5, 14.1.1                 |
| 5.9     | [Inventory of information and other associated assets                  ](27002/EN/a-5.9-Inventory-of-information-and-other-associated-assets.md)  | 08.1.1, 08.1.2                 |
| 5.10    | [Acceptable use of information and other associated assets             ](27002/EN/a-5.10-Acceptable-use-of-information-and-other-associated-assets.md)  | 08.1.3, 08.2.3                 |
| 5.11    | [Return of assets                                                      ](27002/EN/a-5.11-Return-of-assets.md)  | 08.1.4                         |
| 5.12    | [Classification of information                                         ](27002/EN/a-5.12-Classification-of-information.md)  | 08.2.1                         |
| 5.13    | [Labelling of information                                              ](27002/EN/a-5.13-Labelling-of-information.md)  | 08.2.2                         |
| 5.14    | [Information transfer                                                  ](27002/EN/a-5.14-Information-transfer.md)  | 13.2.1, 13.2.2, 13.2.3         |
| 5.15    | [Access control                                                        ](27002/EN/a-5.15-Access-control.md)  | 09.1.1, 09.1.2                 |
| 5.16    | [Identity management                                                   ](27002/EN/a-5.16-Identity-management.md)  | 09.2.1                         |
| 5.17    | [Authentication information                                            ](27002/EN/a-5.17-Authentication-information.md)  | 09.2.4, 09.3.1, 09.4.3         |
| 5.18    | [Access rights                                                         ](27002/EN/a-5.18-Access-rights.md)  | 09.2.2, 09.2.5, 09.2.6         |
| 5.19    | [Information security in supplier relationships                        ](27002/EN/a-5.19-Information-security-in-supplier-relationships.md)  | 15.1.1                         |
| 5.20    | [Addressing information security within supplier agreements            ](27002/EN/a-5.20-Addressing-information-security-within-supplier-agreements.md)  | 15.1.2                         |
| 5.21    | [Managing information security in the ICT supply chain                 ](27002/EN/a-5.21-Managing-information-security-in-the-ICT-supply-chain.md)  | 15.1.3                         |
| 5.22    | [Monitoring, review and change management of supplier services         ](27002/EN/a-5.22-Monitoring-review-and-change-management-of-supplier-services.md)  | 15.2.1, 15.2.2                 |
| 5.23    | [Information security for use of cloud services                        ](27002/EN/a-5.23-Information-security-for-use-of-cloud-services.md)  | New                            |
| 5.24    | [Information security incident management planning and preparation     ](27002/EN/a-5.24-Information-security-incident-management-planning-and-preparation.md)  | 16.1.1                         |
| 5.25    | [Assessment and decision on information security events                ](27002/EN/a-5.25-Assessment-and-decision-on-information-security-events.md)  | 16.1.4                         |
| 5.26    | [Response to information security incidents                            ](27002/EN/a-5.26-Response-to-information-security-incidents.md)  | 16.1.5                         |
| 5.27    | [Learning from information security incidents                          ](27002/EN/a-5.27-Learning-from-information-security-incidents.md)  | 16.1.6                         |
| 5.28    | [Collection of evidence                                                ](27002/EN/a-5.28-Collection-of-evidence.md)  | 16.1.7                         |
| 5.29    | [Information security during disruption                                ](27002/EN/a-5.29-Information-security-during-disruption.md)  | 17.1.1, 17.1.2, 17.1.3         |
| 5.30    | [ICT readiness for business continuity                                 ](27002/EN/a-5.30-ICT-readiness-for-business-continuity.md)  | New                            |
| 5.31    | [Legal, statutory, regulatory and contractual requirements             ](27002/EN/a-5.31-Legal-statutory-regulatory-and-contractual-requirements.md)  | 18.1.1, 18.1.5                 |
| 5.32    | [Intellectual property rights                                          ](27002/EN/a-5.32-Intellectual-property-rights.md)  | 18.1.2                         |
| 5.33    | [Protection of records                                                 ](27002/EN/a-5.33-Protection-of-records.md)  | 18.1.3                         |
| 5.34    | [Privacy and protection of PII                                         ](27002/EN/a-5.34-Privacy-and-protection-of-PII.md)  | 18.1.4                         |
| 5.35    | [Independent review of information security                            ](27002/EN/a-5.35-Independent-review-of-information-security.md)  | 18.2.1                         |
| 5.36    | [Compliance with policies, rules and standards for information security](27002/EN/a-5.36-Compliance-with-policies-rules-and-standards-for-information-security.md)  | 18.2.2, 18.2.3                 |
| 5.37    | [Documented operating procedures                                       ](27002/EN/a-5.37-Documented-operating-procedures.md)  | 12.1.1                         |
| **6**   | **People controls**                                                                                                                                                         |                                |
| 6.1     | [Screening                                                             ](27002/EN/a-6.1-Screening.md)  | 07.1.1                         |
| 6.2     | [Terms and conditions of employment                                    ](27002/EN/a-6.2-Terms-and-conditions-of-employment.md)  | 07.1.2                         |
| 6.3     | [Information security awareness, education and training                ](27002/EN/a-6.3-Information-security-awareness-education-and-training.md)  | 07.2.2                         |
| 6.4     | [Disciplinary process                                                  ](27002/EN/a-6.4-Disciplinary-process.md)  | 07.2.3                         |
| 6.5     | [Responsibilities after termination or change of employment            ](27002/EN/a-6.5-Responsibilities-after-termination-or-change-of-employment.md)  | 07.3.1                         |
| 6.6     | [Confidentiality or non-disclosure agreements                          ](27002/EN/a-6.6-Confidentiality-or-non-disclosure-agreements.md)  | 13.2.4                         |
| 6.7     | [Remote working                                                        ](27002/EN/a-6.7-Remote-working.md)  | 06.2.2                         |
| 6.8     | [Information security event reporting                                  ](27002/EN/a-6.8-Information-security-event-reporting.md)  | 16.1.2, 16.1.3                 |
| **7**   | **Physical controls**                                                                                                                                                       |                                |
| 7.1     | [Physical security perimeters                                          ](27002/EN/a-7.1-Physical-security-perimeters.md)  | 11.1.1                         |
| 7.2     | [Physical entry                                                        ](27002/EN/a-7.2-Physical-entry.md)  | 11.1.2, 11.1.6                 |
| 7.3     | [Securing offices, rooms and facilities                                ](27002/EN/a-7.3-Securing-offices-rooms-and-facilities.md)  | 11.1.3                         |
| 7.4     | [Physical security monitoring                                          ](27002/EN/a-7.4-Physical-security-monitoring.md)  | New                            |
| 7.5     | [Protecting against physical and environmental threats                 ](27002/EN/a-7.5-Protecting-against-physical-and-environmental-threats.md)  | 11.1.4                         |
| 7.6     | [Working in secure areas                                               ](27002/EN/a-7.6-Working-in-secure-areas.md)  | 11.1.5                         |
| 7.7     | [Clear desk and clear screen                                           ](27002/EN/a-7.7-Clear-desk-and-clear-screen.md)  | 11.2.9                         |
| 7.8     | [Equipment siting and protection                                       ](27002/EN/a-7.8-Equipment-siting-and-protection.md)  | 11.2.1                         |
| 7.9     | [Security of assets off-premises                                       ](27002/EN/a-7.9-Security-of-assets-off-premises.md)  | 11.2.6                         |
| 7.10    | [Storage media                                                         ](27002/EN/a-7.10-Storage-media.md)  | 08.3.1, 08.3.2, 08.3.3, 11.2.5 |
| 7.11    | [Supporting utilities                                                  ](27002/EN/a-7.11-Supporting-utilities.md)  | 11.2.2                         |
| 7.12    | [Cabling security                                                      ](27002/EN/a-7.12-Cabling-security.md)  | 11.2.3                         |
| 7.13    | [Equipment maintenance                                                 ](27002/EN/a-7.13-Equipment-maintenance.md)  | 11.2.4                         |
| 7.14    | [Secure disposal or re-use of equipment                                ](27002/EN/a-7.14-Secure-disposal-or-re-use-of-equipment.md)  | 11.2.7                         |
| **8**   | **Technological controls**                                                                                                                                                  |                                |
| 8.1     | [User endpoint devices                                                 ](27002/EN/a-8.1-User-endpoint-devices.md)  | 06.2.1, 11.2.8                 |
| 8.2     | [Privileged access rights                                              ](27002/EN/a-8.2-Privileged-access-rights.md)  | 09.2.3                         |
| 8.3     | [Information access restriction                                        ](27002/EN/a-8.3-Information-access-restriction.md)  | 09.4.1                         |
| 8.4     | [Access to source code                                                 ](27002/EN/a-8.4-Access-to-source-code.md)  | 09.4.5                         |
| 8.5     | [Secure authentication                                                 ](27002/EN/a-8.5-Secure-authentication.md)  | 09.4.2                         |
| 8.6     | [Capacity management                                                   ](27002/EN/a-8.6-Capacity-management.md)  | 12.1.3                         |
| 8.7     | [Protection against malware                                            ](27002/EN/a-8.7-Protection-against-malware.md)  | 12.2.1                         |
| 8.8     | [Management of technical vulnerabilities                               ](27002/EN/a-8.8-Management-of-technical-vulnerabilities.md)  | 12.6.1, 18.2.3                 |
| 8.9     | [Configuration management                                              ](27002/EN/a-8.9-Configuration-management.md)  | New                            |
| 8.10    | [Information deletion                                                  ](27002/EN/a-8.10-Information-deletion.md)  | New                            |
| 8.11    | [Data masking                                                          ](27002/EN/a-8.11-Data-masking.md)  | New                            |
| 8.12    | [Data leakage prevention                                               ](27002/EN/a-8.12-Data-leakage-prevention.md)  | New                            |
| 8.13    | [Information backup                                                    ](27002/EN/a-8.13-Information-backup.md)  | 12.3.1                         |
| 8.14    | [Redundancy of information processing facilities                       ](27002/EN/a-8.14-Redundancy-of-information-processing-facilities.md)  | 17.2.1                         |
| 8.15    | [Logging                                                               ](27002/EN/a-8.15-Logging.md)  | 12.4.1, 12.4.2, 12.4.3         |
| 8.16    | [Monitoring activities                                                 ](27002/EN/a-8.16-Monitoring-activities.md)  | New                            |
| 8.17    | [Clock synchronization                                                 ](27002/EN/a-8.17-Clock-synchronization.md)  | 12.4.4                         |
| 8.18    | [Use of privileged utility programs                                    ](27002/EN/a-8.18-Use-of-privileged-utility-programs.md)  | 09.4.4                         |
| 8.19    | [Installation of software on operational systems                       ](27002/EN/a-8.19-Installation-of-software-on-operational-systems.md)  | 12.5.1, 12.6.2                 |
| 8.20    | [Networks security                                                     ](27002/EN/a-8.20-Networks-security.md)  | 13.1.1                         |
| 8.21    | [Security of network services                                          ](27002/EN/a-8.21-Security-of-network-services.md)  | 13.1.2                         |
| 8.22    | [Segregation of networks                                               ](27002/EN/a-8.22-Segregation-of-networks.md)  | 13.1.3                         |
| 8.23    | [Web filtering                                                         ](27002/EN/a-8.23-Web-filtering.md)  | New                            |
| 8.24    | [Use of cryptography                                                   ](27002/EN/a-8.24-Use-of-cryptography.md)  | 10.1.1, 10.1.2                 |
| 8.25    | [Secure development life cycle                                         ](27002/EN/a-8.25-Secure-development-life-cycle.md)  | 14.2.1                         |
| 8.26    | [Application security requirements                                     ](27002/EN/a-8.26-Application-security-requirements.md)  | 14.1.2, 14.1.3                 |
| 8.27    | [Secure system architecture and engineering principles                 ](27002/EN/a-8.27-Secure-system-architecture-and-engineering-principles.md)  | 14.2.5                         |
| 8.28    | [Secure coding                                                         ](27002/EN/a-8.28-Secure-coding.md)  | New                            |
| 8.29    | [Security testing in development and acceptance                        ](27002/EN/a-8.29-Security-testing-in-development-and-acceptance.md)  | 14.2.8, 14.2.9                 |
| 8.30    | [Outsourced development                                                ](27002/EN/a-8.30-Outsourced-development.md)  | 14.2.7                         |
| 8.31    | [Separation of development, test and production environments           ](27002/EN/a-8.31-Separation-of-development-test-and-production-environments.md)  | 12.1.4, 14.2.6                 |
| 8.32    | [Change management                                                     ](27002/EN/a-8.32-Change-management.md)  | 12.1.2, 14.2.2, 14.2.3, 14.2.4 |
| 8.33    | [Test information                                                      ](27002/EN/a-8.33-Test-information.md)  | 14.3.1                         |
| 8.34    | [Protection of information systems during audit testing                ](27002/EN/a-8.34-Protection-of-information-systems-during-audit-testing.md)  | 12.7.1                         |
