#iso27002/2022/EN
Source:[ Wentz Wu](https://wentzwu.com/2022/02/16/iso-iec-270022022-controls/)
Publishing date February 16, 2022
Retrieved February 17, 2022

ISO 27001:2013 had 114 controls in Annex A, ISO/IEC 27002:2022 introduces 93 controls.

https://ictinstitute.nl/iso270022022-what-is-new/
See also [[ICT Institute's ISO 27002 2022 in plain English]]

Wentz Wu has created a 'control taxonomy' in [](ISO-27002-2022-Controls-categorized.pdf):

- Control type: Preventive, Detective, and Corrective.
- Information security properties: Confidentiality, Integrity and Availability.
- Cybersecurity concepts: Identify, Protect, Detect, Respond and Recover.
- Security domains: Governance_and_Ecosystem, Protection, Defence and Resilience
- Operational capabilities: see below.

Operational capabilities:
1.  Governance
2.  Asset_management
3.  Information_protection
4.  Human_resource_security
5.  Physical_security
6.  System_and_network_security
7.  Application_security
8.  Secure_configuration
9.  Identity_and_access_management
10.  Threat_and_vulnerability_management
11.  Continuity
12.  Supplier_relationships_security
13.  Legal_and_compliance
14.  Information_security_event_management
15.  **Information_security_assurance**

The norm categorizes the controls in 4 sections:
- people controls (i.e. individuals)
- physical controls
- technological controls
- organizational controls

![](ISO_IEC-27002_2022-Controls_I.jpg)

![](ISO_IEC-27002_2022-Controls_II.jpg)