ISO/IEC 27001:2022

Write, approve and publish a top-level security policy plus topic-specific policies, and review them on a set cadence and after major change.

What the ISO 27002 guidance expects the document to say: Requires an information security policy together with supporting topic specific policies. These must be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed on a planned cycle and whenever significant change occurs.

Define and enforce rules for how information and assets may be used and handled.

What the ISO 27002 guidance expects the document to say: Requires rules for acceptable use, and procedures for handling information and its associated assets, to be identified, documented and put into effect.

Recover all organizational assets on exit or role change.

What the ISO 27002 guidance expects the document to say: Requires personnel and other relevant interested parties to return all organisational assets in their possession when employment, a contract or an agreement changes or ends.

Classify information by confidentiality, integrity, availability and interested-party requirements.

What the ISO 27002 guidance expects the document to say: Requires information to be classified according to the organisation's information security needs, judged on confidentiality, integrity and availability and on the requirements of relevant interested parties.

Label information consistently with the classification scheme so handling rules can follow it.

What the ISO 27002 guidance expects the document to say: Requires a matching set of information labelling procedures to be developed and implemented, so that information carries markings consistent with the classification scheme the organisation has adopted.

Put rules, procedures or agreements in place for every way information moves, inside and outside the organization.

What the ISO 27002 guidance expects the document to say: Requires transfer rules, procedures or agreements to be in place for every type of transfer facility, covering transfers within the organisation and between the organisation and outside parties.

Set rules for physical and logical access based on business and security requirements.

What the ISO 27002 guidance expects the document to say: Requires rules governing access to information and the assets tied to it, covering both physical entry and logical access, to be established and implemented on the basis of business need and security requirements.

Manage the full life cycle of identities.

What the ISO 27002 guidance expects the document to say: Requires the full life cycle of identities to be managed, from creation through change to removal.

Control allocation and handling of passwords, keys and other authentication secrets, and advise users on good practice.

What the ISO 27002 guidance expects the document to say: Requires a management process to control how authentication information is issued and looked after over time, including guidance to personnel on handling it appropriately.

Provision, review, modify and remove access rights in line with the access control policy.

What the ISO 27002 guidance expects the document to say: Requires access rights to information and other associated assets to be provisioned, reviewed, modified and removed in accordance with the organisation's topic specific policy and rules on access control.

Define and apply processes to manage the security risk suppliers introduce.

What the ISO 27002 guidance expects the document to say: Requires processes and procedures to be defined and implemented for managing the information security risks that arise from using suppliers' products or services.

Name who owns what in security and make the allocation explicit and traceable.

What the ISO 27002 guidance expects the document to say: Requires information security roles and responsibilities to be defined and allocated in line with what the organisation actually needs, so ownership of each security duty is explicit rather than assumed.

Establish and agree the relevant security requirements in each supplier contract.

What the ISO 27002 guidance expects the document to say: Requires the relevant information security requirements to be established and agreed with each supplier, scaled to the type of supplier relationship involved.

Extend security requirements down the ICT products and services supply chain.

What the ISO 27002 guidance expects the document to say: Requires processes and procedures to be defined and implemented to manage information security risk arising along the supply chain for ICT products and services.

Regularly monitor, review and manage change in supplier security practice and service delivery.

What the ISO 27002 guidance expects the document to say: Requires supplier information security practice and service delivery to be monitored, reviewed and evaluated on a regular basis, and requires change within them to be managed.

Govern acquisition, use, management and exit of cloud services against your security requirements.

What the ISO 27002 guidance expects the document to say: Requires processes for the acquisition, use, management and exit of cloud services to be established in line with the organisation's own information security requirements. Supporting material frames the aim as preserving confidentiality, integrity and availability of information assets held in cloud services.

Define incident roles, processes and readiness before an incident happens.

What the ISO 27002 guidance expects the document to say: Requires the organisation to plan and prepare for incident handling ahead of time. Incident management processes, plus the roles and responsibilities attached to them, must be defined, put in place and communicated.

Triage security events and decide which become incidents.

What the ISO 27002 guidance expects the document to say: Requires information security events to be assessed and a decision taken on whether each event is to be categorised as an information security incident.

Respond to incidents according to the documented procedures.

What the ISO 27002 guidance expects the document to say: Requires information security incidents to be responded to in accordance with documented procedures, rather than improvised case by case.

Feed lessons from incidents back into stronger controls.

What the ISO 27002 guidance expects the document to say: Requires knowledge gained from information security incidents to be fed back into strengthening and improving the information security controls.

Have procedures to identify, collect, acquire and preserve evidence related to security events.

What the ISO 27002 guidance expects the document to say: Requires procedures to be established and used for identifying evidence relating to information security events, then collecting, acquiring and preserving it.

Plan how to keep information security at the right level during disruption.

What the ISO 27002 guidance expects the document to say: Requires the organisation to plan how information security will be maintained at an appropriate level while a disruption is under way.

Plan, implement, maintain and test ICT readiness against business continuity objectives.

What the ISO 27002 guidance expects the document to say: Requires ICT readiness to be planned, implemented, maintained and tested against business continuity objectives and ICT continuity requirements. Supporting material frames this as ICT infrastructure and resources being resilient enough to carry business operations through disruption.

Identify, document and keep current the legal and contractual obligations relevant to security, and your approach to meeting them.

What the ISO 27002 guidance expects the document to say: Requires the legal, statutory, regulatory and contractual requirements bearing on information security, and the organisation's approach to meeting them, to be identified, documented and kept up to date.

Protect records from loss, destruction, falsification, unauthorized access and unauthorized release.

What the ISO 27002 guidance expects the document to say: Requires records to be protected against loss, destruction, falsification, unauthorised access and unauthorised release.

Identify and meet privacy and PII-protection requirements from law, regulation and contract.

What the ISO 27002 guidance expects the document to say: Requires the requirements for preserving privacy and protecting personally identifiable information to be identified and met, in line with applicable laws, regulations and contractual requirements.

Document operating procedures for information processing facilities and make them available to those who need them.

What the ISO 27002 guidance expects the document to say: Requires the operating procedures used to run information processing facilities to be written down and made available to the personnel who need them.

Collect and analyse threat information and turn it into decisions, not just unread feeds.

What the ISO 27002 guidance expects the document to say: Requires information about information security threats to be collected and analysed so that it becomes usable threat intelligence. Supporting material frames this as gathering and applying intelligence proactively, to identify, assess and mitigate emerging threats before they are realised.

Maintain a current asset inventory with owners.

What the ISO 27002 guidance expects the document to say: Requires an inventory of information and of the other assets associated with it to be developed and kept current, and requires that inventory to record ownership of each entry.

Background-check candidates and personnel proportional to risk and classification, within the law.

What the ISO 27002 guidance expects the document to say: Requires background verification checks on all candidates for personnel before they join and on an ongoing basis afterwards, within the bounds of applicable laws, regulations and ethics, and proportionate to business requirements, the classification of information to be accessed and the perceived risk.

State the security responsibilities of both the person and the organization in the employment agreement.

What the ISO 27002 guidance expects the document to say: Requires employment contractual agreements to state what the individual and the organisation are each responsible for with respect to information security.

Give personnel and relevant parties appropriate, current security training for their role.

What the ISO 27002 guidance expects the document to say: Requires personnel and relevant interested parties to receive appropriate information security awareness, education and training, plus regular updates on the security policy, topic specific policies and procedures relevant to their job function. Supporting SME guidance separates merely informing people from making them aware and from training those holding specific roles, and treats repetition as necessary because objectives, threats and available measures keep changing.

Have a formal, communicated disciplinary process for security policy violations.

What the ISO 27002 guidance expects the document to say: Requires a formalised disciplinary process, communicated in advance, so that action can be taken where personnel or other relevant parties have breached information security policy.

Define and enforce security responsibilities that remain valid after an exit or role change.

What the ISO 27002 guidance expects the document to say: Requires the security duties and responsibilities that survive the end of employment, or a move to a different role, to be defined, communicated to the people concerned and enforced.

Identify, document, review and sign NDAs that reflect the organization's protection needs.

What the ISO 27002 guidance expects the document to say: Requires confidentiality or non-disclosure agreements matching the organisation's need to protect information to be identified, documented, reviewed on a regular basis and signed by personnel and by other relevant parties.

Apply security measures when people access, process or store information outside the organization's premises.

What the ISO 27002 guidance expects the document to say: Requires security measures to be implemented when personnel work remotely, protecting information that is accessed, processed or stored outside the organisation's premises.

Give people an easy, timely channel to report observed or suspected security events.

What the ISO 27002 guidance expects the document to say: Requires a mechanism through which personnel can report security events they have observed or suspect, using appropriate channels and without delay.

Define and use security perimeters to protect areas holding information and assets.

What the ISO 27002 guidance expects the document to say: Requires security perimeters to be defined and used to protect any area holding information and the assets associated with it.

Manage storage media across acquisition, use, transport and disposal per classification and handling rules.

What the ISO 27002 guidance expects the document to say: Requires storage media to be managed across their whole life cycle, covering acquisition, use, transportation and disposal, in accordance with the organisation's classification scheme and handling requirements. Older source material adds that disposal should follow formal procedures scaled to the sensitivity of the information held, and that media in transit needs protection against unauthorised access, misuse and corruption.

Verify that sensitive data and licensed software are removed or securely overwritten before disposal or re-use.

What the ISO 27002 guidance expects the document to say: Requires items of equipment containing storage media to be verified before disposal or re-use, confirming that sensitive data and licensed software have been removed or securely overwritten.

Protect secure areas with appropriate entry controls and access points.

What the ISO 27002 guidance expects the document to say: Requires secure areas to be protected by appropriate entry controls and by control over the access points themselves.

Continuously monitor premises for unauthorized physical access.

What the ISO 27002 guidance expects the document to say: Requires premises to be monitored continuously for unauthorised physical access. Supporting material frames this as continuous monitoring of physical security controls so that unauthorised entry and other physical security incidents are detected and responded to.

Design and apply protection against natural disasters and other physical and environmental threats.

What the ISO 27002 guidance expects the document to say: Requires designed and implemented protection against physical and environmental threats. These include natural disasters as well as other physical threats to infrastructure, whether deliberate or accidental.

Enforce clear-desk rules for papers and media and clear-screen rules for processing facilities.

What the ISO 27002 guidance expects the document to say: Requires defined and enforced rules for clearing papers and removable storage media from desks, and for clearing the screens of facilities used to process information.

Protect information stored on, processed by or reachable through user endpoints.

What the ISO 27002 guidance expects the document to say: Requires information stored on, processed by or accessible through user endpoint devices to be protected.

Delete information in systems, devices and media when no longer required.

What the ISO 27002 guidance expects the document to say: Requires information held in information systems, devices or any other storage media to be deleted once it is no longer required. Supporting material frames this as procedures for secure deletion at the point the information ceases to be needed.

Use data masking in line with access policy, business need and applicable law.

What the ISO 27002 guidance expects the document to say: Requires data masking to be used in accordance with the topic specific policy on access control, other related topic specific policies and business requirements, taking applicable legislation into account. Supporting material notes the common case of protecting sensitive data used for testing or development.

Maintain and regularly test backups of information, software and systems per the backup policy.

What the ISO 27002 guidance expects the document to say: Requires backup copies of information, software and systems to be maintained and regularly tested, in line with the agreed topic specific policy on backup. Supporting SME guidance treats regular creation of backups together with tested recovery as the substance of the control, not the copy on its own.

Build enough redundancy into processing facilities to meet availability requirements.

What the ISO 27002 guidance expects the document to say: Requires information processing facilities to be implemented with redundancy sufficient to meet the availability requirements placed on them.

Produce, store, protect and analyse logs of activities, exceptions and faults.

What the ISO 27002 guidance expects the document to say: Requires logs to be produced, stored, protected and analysed, covering activities, exceptions, faults and any other event of relevance. Older source material adds that records of user activity, exceptions and security events should be retained for an agreed period to support later investigation and access control monitoring, and that faults should be logged, analysed and acted on.

Monitor networks, systems and applications for anomalies and act on potential incidents.

What the ISO 27002 guidance expects the document to say: Requires networks, systems and applications to be monitored for anomalous behaviour, with appropriate action taken to evaluate whether what is observed constitutes an information security incident. Secondary commentary notes the deliberate shift to anomalous behaviour as the trigger, responding to cloud era risk.

Securely manage software installation on production systems.

What the ISO 27002 guidance expects the document to say: Requires procedures and measures to be implemented to manage software installation on operational systems securely. Secondary commentary notes that this replaces a narrower restriction on software installation and is oriented to remote working and mobile devices.

Restrict and manage the allocation and use of privileged access.

What the ISO 27002 guidance expects the document to say: Requires the allocation and use of privileged access rights to be restricted and actively managed.

Secure, manage and control networks and network devices.

What the ISO 27002 guidance expects the document to say: Requires networks and network devices to be secured, managed and controlled in order to protect the information carried in systems and applications.

Identify, implement and monitor security mechanisms and service levels for network services.

What the ISO 27002 guidance expects the document to say: Requires the security mechanisms for network services, along with their service levels and the requirements placed on them, to be identified, implemented and monitored, whether provision is in house or outsourced.

Segregate groups of services, users and systems in the network.

What the ISO 27002 guidance expects the document to say: Requires segregation within the organisation's networks, keeping groups of information services, of users and of systems apart from one another.

Manage access to external websites to reduce exposure to malicious content.

What the ISO 27002 guidance expects the document to say: Requires access to external websites to be managed so as to reduce exposure to malicious content.

Define and implement rules for effective use of cryptography and key management.

What the ISO 27002 guidance expects the document to say: Requires defined and implemented rules on using cryptography effectively, including how cryptographic keys are managed.

Establish and apply rules for secure development of software and systems.

What the ISO 27002 guidance expects the document to say: Requires rules covering the secure development of both software and systems to be established and applied.

Identify, specify and approve security requirements when developing or acquiring applications.

What the ISO 27002 guidance expects the document to say: Requires information security requirements to be identified, specified and approved when applications are being developed or acquired.

Establish and apply secure engineering principles to system development.

What the ISO 27002 guidance expects the document to say: Requires principles for engineering secure systems to be established, documented and maintained, then applied across all information system development work.

Apply secure coding principles to software development.

What the ISO 27002 guidance expects the document to say: Requires secure coding principles to be applied to software development.

Define and run security testing across the development life cycle.

What the ISO 27002 guidance expects the document to say: Requires security testing processes to be defined and implemented within the development life cycle.

Restrict access to information and assets per the access control policy.

What the ISO 27002 guidance expects the document to say: Requires access to information and other associated assets to be restricted in accordance with the established topic specific policy on access control.

Direct, monitor and review outsourced system development.

What the ISO 27002 guidance expects the document to say: Requires the organisation to direct, monitor and review the activities involved in outsourced system development. Secondary commentary notes that explicit direction and review were added in the 2022 revision in response to third party risk.

Put changes to facilities and systems through change management procedures.

What the ISO 27002 guidance expects the document to say: Requires change management procedures to govern changes made to information systems and to the facilities that process information. Older source material adds that changes should be controlled by formal, documented and enforced procedures, with risk assessed as part of the process.

Select, protect and manage test information appropriately.

What the ISO 27002 guidance expects the document to say: Requires test information to be appropriately selected, protected and managed.

Implement authentication technologies and procedures based on access restrictions and policy.

What the ISO 27002 guidance expects the document to say: Requires secure authentication technologies and procedures to be implemented, driven by the information access restrictions and the topic specific policy on access control.

Implement malware protection backed by user awareness.

What the ISO 27002 guidance expects the document to say: Requires malware protection to be put in place and reinforced by suitable awareness among users.

Obtain vulnerability information, evaluate exposure, and take appropriate remediation.

What the ISO 27002 guidance expects the document to say: Requires information about technical vulnerabilities in the information systems in use to be obtained, the organisation's exposure to them to be evaluated, and appropriate measures to be taken. Older source material sets out the surrounding process: named roles and responsibilities, identified information sources, a defined reaction timeline, assessment of the risk posed by the vulnerability against the risk of applying the patch, testing before deployment, alternative measures where no patch exists, an audit log of actions taken, and highest risk systems addressed first.

Establish, document, implement, monitor and review secure configurations for hardware, software, services and networks.

What the ISO 27002 guidance expects the document to say: Requires configurations of hardware, software, services and networks, including their security configurations, to be established, documented, implemented, monitored and reviewed. Supporting material frames this as a standing process that keeps systems configured securely and consistently.