#iso27002/2022/EN
# ISO 27002:2022 EN Index

| 2022 ID | Control title                                                                                                                                                               | 2013                           |
| ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
| **F**   | **[[ISO_27002_OT_F Foreword            \|Foreword]]**                                                                                                                       |                                |
| **0**   | **[[ISO_27002_OT_0 Introduction        \|Introduction]]**                                                                                                                   |                                |
| **1**   | **[[ISO_27002_OT_1 Scope               \|Scope]]**                                                                                                                          |                                |
| **2**   | **[[ISO_27002_OT_2 Normative references\|Normative references]]**                                                                                                           |                                |
| **3**   | **Terms, definitions and abbreviated terms**                                                                                                                                |                                |
| 3.1     | **[[ISO_27002_OT_3.1 Terms and definitions\|Terms and definitions]]**                                                                                                       |                                |
| 3.2     | **[[ISO_27002_OT_3.2 Abbreviated terms\|Abbreviated terms]]**                                                                                                               |                                |
| **4**   | **Structure of this document**                                                                                                                                              |                                |
| 4.1     | [[ISO_27002_OT_4.1 Clauses                                                                       \| Clauses                                                              ]] |                                |
| 4.2     | [[ISO_27002_OT_4.2 Themes and attributes                                                         \| Themes and attributes                                                ]] |                                |
| 4.3     | [[ISO_27002_OT_4.3 Control layout                                                                \| Control layout                                                       ]] |                                |
| **5**   | **Organizational controls**                                                                                                                                                 |                                |
| 5.1     | [Policies for information security                                     ](../../../../🧱%20Projects/iso27DIY%20mk%20I/ISO_27002_2022_5.1_MoC%20Policies%20for%20information%20security.md) | 05.1.1, 05.1.2                 |
| 5.2     | [Information security roles and responsibilities                       ](ISO_27002_2022_5.2_MoC%20Information%20security%20roles%20and%20responsibilities.md) | 06.1.1                         |
| 5.3     | [Segregation of duties                                                 ](ISO_27002_2022_5.3_MoC%20Segregation%20of%20duties.md) | 06.1.2                         |
| 5.4     | [Management responsibilities                                           ](ISO_27002_2022_5.4_MoC%20Management%20responsibilities.md) | 07.2.1                         |
| 5.5     | [Contact with authorities                                              ](ISO_27002_2022_5.5_MoC%20Contact%20with%20authorities.md) | 06.1.3                         |
| 5.6     | [Contact with special interest groups                                  ](ISO_27002_2022_5.6_MoC%20Contact%20with%20special%20interest%20groups.md) | 06.1.4                         |
| 5.7     | [Threat intelligence                                                   ](ISO_27002_2022_5.7_MoC%20Threat%20intelligence.md) | New                            |
| 5.8     | [Information security in project management                            ](ISO_27002_2022_5.8_MoC%20Information%20security%20in%20project%20management.md) | 06.1.5, 14.1.1                 |
| 5.9     | [Inventory of information and other associated assets                  ](../../../../ISO_27002_2022_5.9_MoC%20Inventory%20of%20information%20and%20other%20associated%20assets.md) | 08.1.1, 08.1.2                 |
| 5.10    | [Acceptable use of information and other associated assets             ](ISO_27002_2022_5.10_MoC%20Acceptable%20use%20of%20information%20and%20other%20associated%20assets.md) | 08.1.3, 08.2.3                 |
| 5.11    | [Return of assets                                                      ](ISO_27002_2022_5.11_MoC%20Return%20of%20assets.md) | 08.1.4                         |
| 5.12    | [Classification of information                                         ](ISO_27002_2022_5.12_MoC%20Classification%20of%20information.md) | 08.2.1                         |
| 5.13    | [Labelling of information                                              ](ISO_27002_2022_5.13_MoC%20Labelling%20of%20information.md) | 08.2.2                         |
| 5.14    | [Information transfer                                                  ](ISO_27002_2022_5.14_MoC%20Information%20transfer.md) | 13.2.1, 13.2.2, 13.2.3         |
| 5.15    | [Access control                                                        ](ISO_27002_2022_5.15_MoC%20Access%20control.md) | 09.1.1, 09.1.2                 |
| 5.16    | [Identity management                                                   ](ISO_27002_2022_5.16_MoC%20Identity%20management.md) | 09.2.1                         |
| 5.17    | [Authentication information                                            ](ISO_27002_2022_5.17_MoC%20Authentication%20information.md) | 09.2.4, 09.3.1, 09.4.3         |
| 5.18    | [Access rights                                                         ](ISO_27002_2022_5.18_MoC%20Access%20rights.md) | 09.2.2, 09.2.5, 09.2.6         |
| 5.19    | [Information security in supplier relationships                        ](ISO_27002_2022_5.19_MoC%20Information%20security%20in%20supplier%20relationships.md) | 15.1.1                         |
| 5.20    | [Addressing information security within supplier agreements            ](ISO_27002_2022_5.20_MoC%20Addressing%20information%20security%20within%20supplier%20agreements.md) | 15.1.2                         |
| 5.21    | [Managing information security in the ICT supply chain                 ](ISO_27002_2022_5.21_MoC%20Managing%20information%20security%20in%20the%20ICT%20supply%20chain.md) | 15.1.3                         |
| 5.22    | [Monitoring, review and change management of supplier services         ](ISO_27002_2022_5.22_MoC%20Monitoring,%20review%20and%20change%20management%20of%20supplier%20services.md) | 15.2.1, 15.2.2                 |
| 5.23    | [Information security for use of cloud services                        ](ISO_27002_2022_5.23_MoC%20Information%20security%20for%20use%20of%20cloud%20services.md) | New                            |
| 5.24    | [Information security incident management planning and preparation     ](ISO_27002_2022_5.24_MoC%20Information%20security%20incident%20management%20planning%20and%20preparation.md) | 16.1.1                         |
| 5.25    | [Assessment and decision on information security events                ](ISO_27002_2022_5.25_MoC%20Assessment%20and%20decision%20on%20information%20security%20events.md) | 16.1.4                         |
| 5.26    | [Response to information security incidents                            ](ISO_27002_2022_5.26_MoC%20Response%20to%20information%20security%20incidents.md) | 16.1.5                         |
| 5.27    | [Learning from information security incidents                          ](ISO_27002_2022_5.27_MoC%20Learning%20from%20information%20security%20incidents.md) | 16.1.6                         |
| 5.28    | [Collection of evidence                                                ](ISO_27002_2022_5.28_MoC%20Collection%20of%20evidence.md) | 16.1.7                         |
| 5.29    | [Information security during disruption                                ](ISO_27002_2022_5.29_MoC%20Information%20security%20during%20disruption.md) | 17.1.1, 17.1.2, 17.1.3         |
| 5.30    | [ICT readiness for business continuity                                 ](ISO_27002_2022_5.30_MoC%20ICT%20readiness%20for%20business%20continuity.md) | New                            |
| 5.31    | [Legal, statutory, regulatory and contractual requirements             ](ISO_27002_2022_5.31_MoC%20Legal,%20statutory,%20regulatory%20and%20contractual%20requirements.md) | 18.1.1, 18.1.5                 |
| 5.32    | [Intellectual property rights                                          ](ISO_27002_2022_5.32_MoC%20Intellectual%20property%20rights.md) | 18.1.2                         |
| 5.33    | [Protection of records                                                 ](ISO_27002_2022_5.33_MoC%20Protection%20of%20records.md) | 18.1.3                         |
| 5.34    | [Privacy and protection of PII                                         ](ISO_27002_2022_5.34_MoC%20Privacy%20and%20protection%20of%20PII.md) | 18.1.4                         |
| 5.35    | [Independent review of information security                            ](ISO_27002_2022_5.35_MoC%20Independent%20review%20of%20information%20security.md) | 18.2.1                         |
| 5.36    | [Compliance with policies, rules and standards for information security](ISO_27002_2022_5.36_MoC%20Compliance%20with%20policies,%20rules%20and%20standards%20for%20information%20security.md) | 18.2.2, 18.2.3                 |
| 5.37    | [Documented operating procedures                                       ](ISO_27002_2022_5.37_MoC%20Documented%20operating%20procedures.md) | 12.1.1                         |
| **6**   | **People controls**                                                                                                                                                         |                                |
| 6.1     | [Screening                                                             ](ISO_27002_2022_6.1_MoC%20Screening.md) | 07.1.1                         |
| 6.2     | [Terms and conditions of employment                                    ](ISO_27002_2022_6.2_MoC%20Terms%20and%20conditions%20of%20employment.md) | 07.1.2                         |
| 6.3     | [Information security awareness, education and training                ](ISO_27002_2022_6.3_MoC%20Information%20security%20awareness,%20education%20and%20training.md) | 07.2.2                         |
| 6.4     | [Disciplinary process                                                  ](ISO_27002_2022_6.4_MoC%20Disciplinary%20process.md) | 07.2.3                         |
| 6.5     | [Responsibilities after termination or change of employment            ](ISO_27002_2022_6.5_MoC%20Responsibilities%20after%20termination%20or%20change%20of%20employment.md) | 07.3.1                         |
| 6.6     | [Confidentiality or non-disclosure agreements                          ](ISO_27002_2022_6.6_MoC%20Confidentiality%20or%20non-disclosure%20agreements.md) | 13.2.4                         |
| 6.7     | [Remote working                                                        ](ISO_27002_2022_6.7_MoC%20Remote%20working.md) | 06.2.2                         |
| 6.8     | [Information security event reporting                                  ](ISO_27002_2022_6.8_MoC%20Information%20security%20event%20reporting.md) | 16.1.2, 16.1.3                 |
| **7**   | **Physical controls**                                                                                                                                                       |                                |
| 7.1     | [Physical security perimeters                                          ](ISO_27002_2022_7.1_MoC%20Physical%20security%20perimeters.md) | 11.1.1                         |
| 7.2     | [Physical entry                                                        ](ISO_27002_2022_7.2_MoC%20Physical%20entry.md) | 11.1.2, 11.1.6                 |
| 7.3     | [Securing offices, rooms and facilities                                ](ISO_27002_2022_7.3_MoC%20Securing%20offices,%20rooms%20and%20facilities.md) | 11.1.3                         |
| 7.4     | [Physical security monitoring                                          ](ISO_27002_2022_7.4_MoC%20Physical%20security%20monitoring.md) | New                            |
| 7.5     | [Protecting against physical and environmental threats                 ](ISO_27002_2022_7.5_MoC%20Protecting%20against%20physical%20and%20environmental%20threats.md) | 11.1.4                         |
| 7.6     | [Working in secure areas                                               ](ISO_27002_2022_7.6_MoC%20Working%20in%20secure%20areas.md) | 11.1.5                         |
| 7.7     | [Clear desk and clear screen                                           ](ISO_27002_2022_7.7_MoC%20Clear%20desk%20and%20clear%20screen.md) | 11.2.9                         |
| 7.8     | [Equipment siting and protection                                       ](ISO_27002_2022_7.8_MoC%20Equipment%20siting%20and%20protection.md) | 11.2.1                         |
| 7.9     | [Security of assets off-premises                                       ](ISO_27002_2022_7.9_MoC%20Security%20of%20assets%20off-premises.md) | 11.2.6                         |
| 7.10    | [Storage media                                                         ](ISO_27002_2022_7.10_MoC%20Storage%20media.md) | 08.3.1, 08.3.2, 08.3.3, 11.2.5 |
| 7.11    | [Supporting utilities                                                  ](ISO_27002_2022_7.11_MoC%20Supporting%20utilities.md) | 11.2.2                         |
| 7.12    | [Cabling security                                                      ](ISO_27002_2022_7.12_MoC%20Cabling%20security.md) | 11.2.3                         |
| 7.13    | [Equipment maintenance                                                 ](ISO_27002_2022_7.13_MoC%20Equipment%20maintenance.md) | 11.2.4                         |
| 7.14    | [Secure disposal or re-use of equipment                                ](ISO_27002_2022_7.14_MoC%20Secure%20disposal%20or%20re-use%20of%20equipment.md) | 11.2.7                         |
| **8**   | **Technological controls**                                                                                                                                                  |                                |
| 8.1     | [User endpoint devices                                                 ](ISO_27002_2022_8.1_MoC%20User%20endpoint%20devices.md) | 06.2.1, 11.2.8                 |
| 8.2     | [Privileged access rights                                              ](ISO_27002_2022_8.2_MoC%20Privileged%20access%20rights.md) | 09.2.3                         |
| 8.3     | [Information access restriction                                        ](ISO_27002_2022_8.3_MoC%20Information%20access%20restriction.md) | 09.4.1                         |
| 8.4     | [Access to source code                                                 ](ISO_27002_2022_8.4_MoC%20Access%20to%20source%20code.md) | 09.4.5                         |
| 8.5     | [Secure authentication                                                 ](ISO_27002_2022_8.5_MoC%20Secure%20authentication.md) | 09.4.2                         |
| 8.6     | [Capacity management                                                   ](ISO_27002_2022_8.6_MoC%20Capacity%20management.md) | 12.1.3                         |
| 8.7     | [Protection against malware                                            ](ISO_27002_2022_8.7_MoC%20Protection%20against%20malware.md) | 12.2.1                         |
| 8.8     | [Management of technical vulnerabilities                               ](ISO_27002_2022_8.8_MoC%20Management%20of%20technical%20vulnerabilities.md) | 12.6.1, 18.2.3                 |
| 8.9     | [Configuration management                                              ](ISO_27002_2022_8.9_MoC%20Configuration%20management.md) | New                            |
| 8.10    | [Information deletion                                                  ](ISO_27002_2022_8.10_MoC%20Information%20deletion.md) | New                            |
| 8.11    | [Data masking                                                          ](ISO_27002_2022_8.11_MoC%20Data%20masking.md) | New                            |
| 8.12    | [Data leakage prevention                                               ](ISO_27002_2022_8.12_MoC%20Data%20leakage%20prevention.md) | New                            |
| 8.13    | [Information backup                                                    ](ISO_27002_2022_8.13_MoC%20Information%20backup.md) | 12.3.1                         |
| 8.14    | [Redundancy of information processing facilities                       ](ISO_27002_2022_8.14_MoC%20Redundancy%20of%20information%20processing%20facilities.md) | 17.2.1                         |
| 8.15    | [Logging                                                               ](ISO_27002_2022_8.15_MoC%20Logging.md) | 12.4.1, 12.4.2, 12.4.3         |
| 8.16    | [Monitoring activities                                                 ](ISO_27002_2022_8.16_MoC%20Monitoring%20activities.md) | New                            |
| 8.17    | [Clock synchronization                                                 ](ISO_27002_2022_8.17_MoC%20Clock%20synchronization.md) | 12.4.4                         |
| 8.18    | [Use of privileged utility programs                                    ](ISO_27002_2022_8.18_MoC%20Use%20of%20privileged%20utility%20programs.md) | 09.4.4                         |
| 8.19    | [Installation of software on operational systems                       ](ISO_27002_2022_8.19_MoC%20Installation%20of%20software%20on%20operational%20systems.md) | 12.5.1, 12.6.2                 |
| 8.20    | [Networks security                                                     ](ISO_27002_2022_8.20_MoC%20Networks%20security.md) | 13.1.1                         |
| 8.21    | [Security of network services                                          ](ISO_27002_2022_8.21_MoC%20Security%20of%20network%20services.md) | 13.1.2                         |
| 8.22    | [Segregation of networks                                               ](ISO_27002_2022_8.22_MoC%20Segregation%20of%20networks.md) | 13.1.3                         |
| 8.23    | [Web filtering                                                         ](ISO_27002_2022_8.23_MoC%20Web%20filtering.md) | New                            |
| 8.24    | [Use of cryptography                                                   ](ISO_27002_2022_8.24_MoC%20Use%20of%20cryptography.md) | 10.1.1, 10.1.2                 |
| 8.25    | [Secure development life cycle                                         ](ISO_27002_2022_8.25_MoC%20Secure%20development%20life%20cycle.md) | 14.2.1                         |
| 8.26    | [Application security requirements                                     ](ISO_27002_2022_8.26_MoC%20Application%20security%20requirements.md) | 14.1.2, 14.1.3                 |
| 8.27    | [Secure system architecture and engineering principles                 ](ISO_27002_2022_8.27_MoC%20Secure%20system%20architecture%20and%20engineering%20principles.md) | 14.2.5                         |
| 8.28    | [Secure coding                                                         ](ISO_27002_2022_8.28_MoC%20Secure%20coding.md) | New                            |
| 8.29    | [Security testing in development and acceptance                        ](ISO_27002_2022_8.29_MoC%20Security%20testing%20in%20development%20and%20acceptance.md) | 14.2.8, 14.2.9                 |
| 8.30    | [Outsourced development                                                ](ISO_27002_2022_8.30_MoC%20Outsourced%20development.md) | 14.2.7                         |
| 8.31    | [Separation of development, test and production environments           ](ISO_27002_2022_8.31_MoC%20Separation%20of%20development,%20test%20and%20production%20environments.md) | 12.1.4, 14.2.6                 |
| 8.32    | [Change management                                                     ](ISO_27002_2022_8.32_MoC%20Change%20management.md) | 12.1.2, 14.2.2, 14.2.3, 14.2.4 |
| 8.33    | [Test information                                                      ](ISO_27002_2022_8.33_MoC%20Test%20information.md) | 14.3.1                         |
| 8.34    | [Protection of information systems during audit testing                ](ISO_27002_2022_8.34_MoC%20Protection%20of%20information%20systems%20during%20audit%20testing.md) | 12.7.1                         |
