← Back to all briefings
Developer 6 min read Published Updated Credibility 85/100

SDLC governance briefing — ISO/IEC 27002:2022 reshapes control references

The ISO/IEC 27002:2022 overhaul condenses controls, adds threat-driven attributes, and pushes security leaders to redesign control catalogues, tooling integrations, and supplier governance in lockstep with ISO 27001 updates.

Zeph Tech Research Lead

Research lead, Zeph Tech

Timeline plotting source publication cadence sized by credibility.
2 publication timestamps supporting this briefing. Source data (JSON)

Executive briefing: ISO/IEC 27002:2022 replaces the 2013 control catalogue with 93 streamlined controls organized into four themes—Organizational, People, Physical, and Technological—and introduces attributes that map controls to security concepts such as threat type, information security properties, cybersecurity concepts, operational capabilities, and security domains. Security leaders now need to reconcile enterprise control libraries, tooling configurations, and supplier requirements with the new structure ahead of the expected ISO/IEC 27001:2022 management-system revision. Early movers are remapping controls to NIST CSF, CIS 18, and sector regulators to avoid audit gaps when certification bodies transition during 2022–2023.

Key changes in ISO/IEC 27002:2022

The new edition consolidates 114 controls from the 2013 version into 93 by merging overlapping requirements and adding 11 entirely new controls, including threat intelligence, information security for cloud services, business continuity preparedness, data masking, data leakage prevention, configuration management, and monitoring activities. It removes Annex A reference control objectives, reimagining the standard as a guidance document with attribute filters. Each control now includes a purpose, guidance, and implementation considerations, offering clarity for control owners in both IT and OT environments.

Attributes use a six-dimension taxonomy. Organizations can tag controls by threat type (e.g., accidental or deliberate), by information security property (confidentiality, integrity, availability), by cybersecurity concept (identify, protect, detect, respond, recover), by operational capability (governance, assets, identity, resilience), by security domain (governance and ecosystem, protection, defence, resilience), and by data lifecycle stage. The attribute tables enable risk owners to build custom views for cloud, privacy, industrial control systems, or DevSecOps initiatives without inventing new taxonomies.

Operational priorities

Operations and platform teams must translate the updated controls into actionable work plans:

  • Control library remapping: Inventory existing controls aligned to ISO/IEC 27001 Annex A, NIST SP 800-53, SOC 2, or local regimes such as the Monetary Authority of Singapore (MAS) TRM. Map each control to the 93 new clauses, noting merged controls like access control policy and user access management. Document compensating controls where functionality is split across multiple tools.
  • Playbook updates: Rebuild incident response, vulnerability management, and change-management runbooks so that references point to the new control identifiers (e.g., 5.7 Threat intelligence, 8.16 Monitoring activities). Update cross-references in GRC platforms, security orchestration, and service management workflows.
  • Metrics recalibration: Define outcome metrics for new controls such as data masking coverage, DLP rule effectiveness, and cloud service security baselines. Align metrics with board dashboards, the ISO/IEC 27014 governance standard, and regulatory KPIs (e.g., UK PRA SS1/21, EU DORA draft metrics).
  • Integration with OT and IoT: Evaluate how new controls impact operational technology, especially 7.4 Physical security monitoring and 8.9 Configuration management. Map to IEC 62443 requirements for industrial control systems to avoid diverging policies between IT and OT networks.
  • Automation opportunities: Use attribute filters to prioritise automation. For example, controls tagged as “monitor” and “detect” lend themselves to SIEM or SOAR integrations, while “protect” controls may require endpoint hardening or identity governance automation.

Governance and compliance implications

Governance bodies must prepare for certification transition windows:

  • Certification timing: International Accreditation Forum (IAF) expectations indicate a 24-month transition once ISO/IEC 27001:2022 is published. Boards should confirm whether surveillance or recertification audits fall within 2023–2024 and allocate resources for readiness assessments.
  • Policy management: Revise information security policies, standards, and procedures so that numbering and terminology align with the new control set. Maintain a crosswalk to historical references for regulators and customers who still cite the 2013 edition.
  • Risk management alignment: Integrate the attribute model into enterprise risk registers. Risk committees can filter controls by threat type to ensure emerging risk statements (e.g., supply-chain compromise, insider abuse) map to specific mitigation activities.
  • Board reporting: Provide directors with briefings explaining how the new structure simplifies oversight. Highlight new controls responding to cloud adoption, privacy, and resilience so the board can challenge management on coverage and budget.
  • Assurance coordination: Coordinate with internal audit to update testing plans and sampling methodologies. Ensure auditors understand new control descriptions, especially where multiple legacy controls merge into one (e.g., 5.19 Information security in supplier relationships now bundles prior clauses).

Technology and data considerations

Technology leaders must validate that platforms support the new control landscape:

  • GRC tooling: Update control repositories, workflows, and evidence collection tasks in governance, risk, and compliance systems. Ensure APIs feed the new control identifiers into integrated ticketing or DevOps tools.
  • Security analytics: Expand logging and monitoring to meet controls 8.16 (Monitoring activities) and 8.23 (Web filtering). Confirm event retention aligns with zero-trust and insider threat programmes, and that analytics support attribute-driven filtering.
  • Cloud security posture management: Map CSPM rulesets to the new cloud-focused controls such as 5.23 (Information security for use of cloud services) and 8.8 (Secure coding). Validate that tagging strategies capture data residency, encryption, and privileged access metrics.
  • Identity and access management: Align identity governance processes with controls 5.17 (Authentication information) and 8.3 (Identity management). Strengthen lifecycle automation, privileged access reviews, and conditional access to satisfy increased auditor scrutiny.
  • Data protection: Integrate data masking, DLP, and encryption tooling to address 8.10 (Data masking) and 8.12 (Data leakage prevention). Document which data domains and systems receive coverage, linking to privacy impact assessments.

Sourcing and supplier engagement

Procurement and third-party risk managers must extend ISO/IEC 27002:2022 expectations into contracts:

  • Contractual updates: Revise supplier security appendices to reference the new control identifiers. When customers demand ISO/IEC 27001 certification, clarify transition timelines and audit evidence expectations, especially for managed service providers and SaaS platforms.
  • Shared responsibility matrices: For cloud and outsourcing engagements, refresh RACI charts showing which party owns controls covering infrastructure, platform, and application layers. Use the attribute model to signal detection versus response responsibilities.
  • Due diligence questionnaires: Update third-party risk questionnaires to test compliance with new controls like threat intelligence sharing and ICT continuity. Incorporate regulatory requirements such as EU Digital Operational Resilience Act (DORA) articles on third-party concentration risk.
  • Assurance artefacts: Request updated independent assessments from suppliers, including SOC 2 reports, penetration testing summaries, or ISO/IEC 27017 cloud extensions. Align evidence cadence with contract renewal cycles.
  • Capacity building: Provide supplier enablement sessions explaining the attribute filters and how they can reuse evidence across frameworks. Smaller vendors may need templates or secure portals to submit documentation efficiently.

Implementation roadmap

To maintain certification momentum, design a phased programme:

  1. Gap analysis (0–60 days): Map current controls, policies, and tooling to the 2022 edition. Prioritise high-impact gaps linked to new controls or merged clauses that could leave residual risk.
  2. Control redesign (60–180 days): Update procedures, automation scripts, and monitoring thresholds. Validate effectiveness through tabletop exercises, automated tests, and independent reviews.
  3. Evidence refresh (180–270 days): Collect artefacts demonstrating operating effectiveness. Ensure evidence repositories capture attribute tags for reuse across frameworks and customer audits.
  4. Certification transition (270–360 days): Coordinate with certification bodies to schedule transition audits. Prepare communication packages for customers and regulators describing the new control environment and any residual remediation timelines.

Strategic outlook

The 2022 revision positions ISO/IEC 27002 as a flexible, threat-informed control set. Organizations that quickly adopt the attribute framework can better align with regional regulations (EU NIS2, Singapore Cybersecurity Code of Practice), sector rules (US FFIEC, UK NCSC CAF), and emerging guidance such as the NIST Cybersecurity Framework 2.0. Integrating the new controls into DevSecOps pipelines, zero-trust architectures, and supplier ecosystems will demonstrate resilience to boards, customers, and regulators throughout the ISO/IEC 27001:2022 transition period.

Timeline plotting source publication cadence sized by credibility.
2 publication timestamps supporting this briefing. Source data (JSON)
Horizontal bar chart of credibility scores per cited source.
Credibility scores for every source cited in this briefing. Source data (JSON)

Related briefings

Curated signals from the same pillar or overlapping topics.

Continue in the Developer pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

  • ISO/IEC 27002:2022
  • Security controls
  • DevSecOps
Back to curated briefings