ISO/IEC 27002:2022: the evidence behind every control

93 controls. For each, the artefacts auditors ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Organizational controls

5.1Policies for information security hard 5.2Information security roles and responsibilities hard 5.3Segregation of duties hard 5.4Management responsibilities hard 5.5Contact with authorities hard 5.6Contact with special interest groups hard 5.7Threat intelligence hard 5.8Information security in project management hard 5.9Inventory of information and other associated assets hard 5.10Acceptable use of information and other associated assets hard 5.11Return of assets hard 5.12Classification of information hard 5.13Labelling of information hard 5.14Information transfer hard 5.15Access control hard 5.16Identity management hard 5.17Authentication information moderate 5.18Access rights hard 5.19Information security in supplier relationships hard 5.20Addressing information security within supplier agreements hard 5.21Managing information security in the ICT supply chain hard 5.22Monitoring, review and change management of supplier services hard 5.23Information security for use of cloud services hard 5.24Information security incident management planning and preparation hard 5.25Assessment and decision on information security events hard 5.26Response to information security incidents hard 5.27Learning from information security incidents hard 5.28Collection of evidence hard 5.29Information security during disruption hard 5.30ICT readiness for business continuity hard 5.31Legal, statutory, regulatory and contractual requirements hard 5.32Intellectual property rights hard 5.33Protection of records hard 5.34Privacy and protection of PII hard 5.35Independent review of information security hard 5.36Compliance with policies, rules and standards for information security hard 5.37Documented operating procedures hard

People controls

6.1Screening hard 6.2Terms and conditions of employment hard 6.3Information security awareness, education and training hard 6.4Disciplinary process hard 6.5Responsibilities after termination or change of employment hard 6.6Confidentiality or non-disclosure agreements hard 6.7Remote working hard 6.8Information security event reporting hard

Physical controls

7.1Physical security perimeters hard 7.2Physical entry hard 7.3Securing offices, rooms and facilities hard 7.4Physical security monitoring easy 7.5Protecting against physical and environmental threats hard 7.6Working in secure areas hard 7.7Clear desk and clear screen hard 7.8Equipment siting and protection hard 7.9Security of assets off-premises hard 7.10Storage media hard 7.11Supporting utilities hard 7.12Cabling security hard 7.13Equipment maintenance hard 7.14Secure disposal or re-use of equipment hard

Technological controls

8.1User endpoint devices hard 8.2Privileged access rights hard 8.3Information access restriction hard 8.4Access to source code hard 8.5Secure authentication moderate 8.6Capacity management moderate 8.7Protection against malware moderate 8.8Management of technical vulnerabilities moderate 8.9Configuration management moderate 8.10Information deletion hard 8.11Data masking hard 8.12Data leakage prevention hard 8.13Information backup moderate 8.14Redundancy of information processing facilities hard 8.15Logging easy 8.16Monitoring activities easy 8.17Clock synchronization moderate 8.18Use of privileged utility programs hard 8.19Installation of software on operational systems hard 8.20Networks security hard 8.21Security of network services hard 8.22Segregation of networks hard 8.23Web filtering hard 8.24Use of cryptography hard 8.25Secure development life cycle hard 8.26Application security requirements moderate 8.27Secure system architecture and engineering principles hard 8.28Secure coding hard 8.29Security testing in development and acceptance hard 8.30Outsourced development hard 8.31Separation of development, test and production environments hard 8.32Change management hard 8.33Test information hard 8.34Protection of information systems during audit testing hard