ISO/IEC 27001:2022
Information security management systems standard. Specifies requirements for establishing, implementing, maintaining and continually improving an ISMS.
AC (17) AT (5) AU (16) CA (8) CM (13) CP (11) IA (8) IR (8) MA (7) MP (8) PE (22) PL (8) PM (24) PS (8) PT (8) RA (7) SA (14) SC (12) SI (10) SR (9)
AC Access Control
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| AC-01 | Policy and Procedures | 5.25.37.5A.5.1A.5.2A.5.4A.5.15A.5.31A.5.36A.5.37 |
| AC-02 | Account Management | A.5.15A.5.16A.5.18A.8.2 |
| AC-03 | Access Enforcement | A.5.15A.5.33A.8.3A.8.4A.8.18A.8.20A.8.26 |
| AC-04 | Information Flow Enforcement | A.5.14A.8.3A.8.12A.8.20A.8.22A.8.23 |
| AC-05 | Separation of Duties | A.5.3 |
| AC-06 | Least Privilege | A.5.15A.5.18A.8.2A.8.3A.8.18 |
| AC-07 | Unsuccessful Logon Attempts | A.8.5 |
| AC-08 | System Use Notification | A.8.5 |
| AC-09 | Previous Logon Notification | A.8.5 |
| AC-11 | Device Lock | A.7.7A.8.1 |
| AC-16 | Security and Privacy Attributes | A.5.13 |
| AC-17 | Remote Access | A.5.14A.5.15A.6.7A.7.9 |
| AC-18 | Wireless Access | A.5.14A.8.20 |
| AC-19 | Access Control for Mobile Devices | A.5.14A.7.9A.8.1 |
| AC-20 | Use of External Systems | A.5.10A.5.14A.5.23A.7.9A.8.20 |
| AC-24 | Access Control Decisions | A.5.15A.8.3 |
| AC-25 | Reference Monitor | A.5.18 |
AT Awareness and Training
AU Audit and Accountability
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| AU-01 | Policy and Procedures | 5.25.37.5A.5.1A.5.2A.5.4A.5.31A.5.36A.5.37A.8.15 |
| AU-02 | Event Logging | 7.5A.8.15 |
| AU-03 | Content of Audit Records | 7.5A.5.28A.8.15 |
| AU-04 | Audit Log Storage Capacity | 7.5A.8.6A.8.15 |
| AU-05 | Response to Audit Logging Process Failures | 7.5A.8.15 |
| AU-06 | Audit Record Review, Analysis, and Reporting | 7.59.2A.5.25A.5.28A.5.36A.6.8A.8.15A.8.16A.8.34 |
| AU-07 | Audit Record Reduction and Report Generation | 7.5A.8.15 |
| AU-08 | Time Stamps | 7.5A.8.15A.8.17 |
| AU-09 | Protection of Audit Information | 7.5A.5.33A.8.15 |
| AU-10 | Non-repudiation | 7.5A.8.15 |
| AU-11 | Audit Record Retention | 7.5A.5.28A.5.33A.8.15 |
| AU-12 | Audit Record Generation | 7.5A.8.15 |
| AU-13 | Monitoring for Information Disclosure | 7.5A.8.12A.8.16 |
| AU-14 | Session Audit | 7.5A.8.15 |
| AU-15 | Alternate Audit Logging Capability | 7.5 |
| AU-16 | Cross-organizational Audit Logging | 7.5 |
CA Security Assessment and Authorization
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| CA-01 | Policy and Procedures | 5.25.37.59.29.3A.5.1A.5.2A.5.4A.5.31A.5.36A.5.37 |
| CA-02 | Control Assessments | 8.19.2A.5.30A.5.35A.5.36A.8.29A.8.34 |
| CA-03 | Information Exchange | A.5.14A.8.21 |
| CA-05 | Plan of Action and Milestones | 6.1.38.39.310.2 |
| CA-06 | Authorization | 9.3 |
| CA-07 | Continuous Monitoring | 9.19.29.310.1A.5.22A.5.35A.5.36A.8.16 |
| CA-08 | Penetration Testing | A.8.34 |
| CA-09 | Internal System Connections | A.8.20 |
CM Configuration Management
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| CM-01 | Policy and Procedures | 5.25.37.5A.5.1A.5.2A.5.4A.5.31A.5.36A.5.37A.8.9 |
| CM-02 | Baseline Configuration | A.8.9 |
| CM-03 | Configuration Change Control | 6.38.19.3A.8.9A.8.32 |
| CM-04 | Impact Analyses | 6.3A.5.36A.8.9A.8.31A.8.32 |
| CM-05 | Access Restrictions for Change | A.8.2A.8.4A.8.9A.8.19A.8.31A.8.32 |
| CM-06 | Configuration Settings | A.8.9 |
| CM-07 | Least Functionality | A.8.1A.8.9A.8.18A.8.19 |
| CM-08 | System Component Inventory | A.5.9A.8.9 |
| CM-09 | Configuration Management Plan | A.5.2A.8.9 |
| CM-10 | Software Usage Restrictions | A.5.32A.8.9 |
| CM-11 | User-installed Software | A.8.9A.8.18A.8.19 |
| CM-12 | Information Location | A.5.9 |
| CM-14 | Signed Components | A.8.9A.8.19 |
CP Contingency Planning
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| CP-01 | Policy and Procedures | 5.25.37.5A.5.1A.5.2A.5.4A.5.29A.5.31A.5.36A.5.37 |
| CP-02 | Contingency Plan | 7.5A.5.2A.5.29A.5.30A.8.6A.8.14 |
| CP-03 | Contingency Training | A.5.29A.6.3 |
| CP-04 | Contingency Plan Testing | A.5.29A.5.30 |
| CP-06 | Alternate Storage Site | A.5.29A.7.5A.8.13A.8.14 |
| CP-07 | Alternate Processing Site | A.5.29A.5.30A.7.5A.8.14 |
| CP-08 | Telecommunications Services | A.5.29A.5.30A.7.11A.8.14 |
| CP-09 | System Backup | A.5.29A.5.30A.5.33A.8.13 |
| CP-10 | System Recovery and Reconstitution | A.5.29A.5.30 |
| CP-11 | Alternate Communications Protocols | A.5.29 |
| CP-13 | Alternative Security Mechanisms | A.5.29A.5.30 |
IA Identification and Authentication
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| IA-01 | Policy and Procedures | 5.25.37.5A.5.1A.5.2A.5.4A.5.16A.5.31A.5.36A.5.37 |
| IA-02 | Identification and Authentication (Organizational Users) | A.5.16A.8.5 |
| IA-04 | Identifier Management | A.5.16 |
| IA-05 | Authenticator Management | A.5.16A.5.17A.8.5 |
| IA-06 | Authentication Feedback | A.5.17A.8.5 |
| IA-08 | Identification and Authentication (Non-organizational Users) | A.5.16A.8.5 |
| IA-11 | Re-authentication | A.8.5 |
| IA-12 | Identity Proofing | A.5.16 |
IR Incident Response
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| IR-01 | Policy and Procedures | 5.25.37.5A.5.1A.5.2A.5.4A.5.24A.5.31A.5.36A.5.37 |
| IR-02 | Incident Response Training | A.5.24A.6.3 |
| IR-03 | Incident Response Testing | A.5.24A.5.27 |
| IR-04 | Incident Handling | A.5.25A.5.26A.5.27A.5.28A.8.16 |
| IR-05 | Incident Monitoring | A.5.25 |
| IR-06 | Incident Reporting | A.5.5A.5.25A.5.26A.5.27A.6.8 |
| IR-07 | Incident Response Assistance | 7.4A.5.26A.6.8 |
| IR-08 | Incident Response Plan | 7.5A.5.24 |
MA Maintenance
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| MA-01 | Policy and Procedures | 5.25.37.5A.5.1A.5.2A.5.4A.5.37A.7.13 |
| MA-02 | Controlled Maintenance | A.7.10A.7.13A.8.10 |
| MA-03 | Maintenance Tools | A.7.13 |
| MA-04 | Nonlocal Maintenance | A.7.13 |
| MA-05 | Maintenance Personnel | A.7.13 |
| MA-06 | Timely Maintenance | A.7.13 |
| MA-07 | Field Maintenance | A.7.13 |
MP Media Protection
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| MP-01 | Policy and Procedures | 5.25.37.5A.5.1A.5.2A.5.4A.5.31A.5.36A.5.37A.7.10 |
| MP-02 | Media Access | A.5.10A.7.7A.7.10 |
| MP-03 | Media Marking | A.5.13A.7.10 |
| MP-04 | Media Storage | A.5.10A.7.7A.7.10A.8.10 |
| MP-05 | Media Transport | A.5.10A.7.9A.7.10 |
| MP-06 | Media Sanitization | A.5.10A.7.10A.7.14A.8.10 |
| MP-07 | Media Use | A.5.10A.7.10A.7.14 |
| MP-08 | Media Downgrading | A.7.10 |
PE Physical and Environmental Protection
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| PE-01 | Policy and Procedures | 5.25.37.5A.5.1A.5.2A.5.4A.5.31A.5.36A.5.37A.7.8 |
| PE-02 | Physical Access Authorizations | A.7.2A.7.6 |
| PE-03 | Physical Access Control | A.7.1A.7.2A.7.3A.7.4A.7.6 |
| PE-04 | Access Control for Transmission | A.7.1A.7.2A.7.12 |
| PE-05 | Access Control for Output Devices | A.7.2A.7.3A.7.7 |
| PE-06 | Monitoring Physical Access | A.7.2A.7.4A.8.16 |
| PE-07 | Visitor Control | A.7.6 |
| PE-08 | Visitor Access Records | A.7.2A.7.4 |
| PE-09 | Power Equipment and Cabling | A.7.5A.7.8A.7.11A.7.12 |
| PE-10 | Emergency Shutoff | A.7.5A.7.11 |
| PE-11 | Emergency Power | A.7.5A.7.11 |
| PE-12 | Emergency Lighting | A.7.5A.7.11 |
| PE-13 | Fire Protection | A.7.5A.7.8 |
| PE-14 | Environmental Controls | A.7.5A.7.8A.7.11 |
| PE-15 | Water Damage Protection | A.7.5A.7.8A.7.11 |
| PE-16 | Delivery and Removal | A.5.10A.7.2A.7.10 |
| PE-17 | Alternate Work Site | A.5.14A.6.7A.7.9 |
| PE-18 | Location of System Components | A.5.10A.7.5A.7.8 |
| PE-19 | Information Leakage | A.7.5A.7.8A.8.12 |
| PE-20 | Asset Monitoring and Tracking | A.5.10 |
| PE-22 | Component Marking | A.5.13 |
| PE-23 | Facility Location | A.7.5A.7.8 |
PL Planning
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| PL-01 | Policy and Procedures | 5.25.37.5A.5.1A.5.2A.5.4A.5.31A.5.36A.5.37 |
| PL-02 | System Security and Privacy Plans | 7.58.110.2A.5.8A.5.34A.5.37 |
| PL-04 | Rules of Behavior | 7.4A.5.4A.5.10A.5.31A.6.2 |
| PL-07 | Concept of Operations | 8.1A.5.8 |
| PL-08 | Security and Privacy Architectures | A.5.8 |
| PL-09 | Central Management | 4.48.1 |
| PL-10 | Baseline Selection | 4.36.16.1.38.1 |
| PL-11 | Baseline Tailoring | 6.16.1.38.1 |
PM Program Management
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| PM-01 | Information Security Program Plan | 4.14.24.34.45.15.25.36.16.27.47.58.19.310.1A.5.1A.5.2A.5.4A.5.31A.5.36 |
| PM-02 | Information Security Program Leadership Role | 4.45.15.3A.5.2A.5.4 |
| PM-03 | Information Security and Privacy Resources | 4.45.16.27.1 |
| PM-04 | Plan of Action and Milestones Process | 6.16.1.36.27.58.39.310.2 |
| PM-05 | System Inventory | A.5.9 |
| PM-06 | Measures of Performance | 4.45.36.16.29.19.310.1A.5.35A.5.36 |
| PM-07 | Enterprise Architecture | 4.3A.5.8 |
| PM-08 | Critical Infrastructure Plan | 4.14.2 |
| PM-09 | Risk Management Strategy | 4.34.46.16.1.36.27.510.1 |
| PM-10 | Authorization Process | 4.3A.5.2 |
| PM-11 | Mission and Business Process Definition | 4.14.2 |
| PM-13 | Security and Privacy Workforce | 5.17.27.3A.5.4A.6.3 |
| PM-14 | Testing, Training, and Monitoring | 6.29.1 |
| PM-15 | Security and Privacy Groups and Associations | 7.4A.5.5A.5.6 |
| PM-16 | Threat Awareness Program | 7.2A.5.6A.5.7 |
| PM-18 | Privacy Program Plan | A.5.34 |
| PM-25 | Minimization of Personally Identifiable Information Used in Testing, Training, and Research | A.5.34 |
| PM-26 | Complaint Management | A.5.34 |
| PM-27 | Privacy Reporting | A.5.34 |
| PM-28 | Risk Framing | 4.36.16.27.47.5 |
| PM-29 | Risk Management Program Leadership Roles | 5.15.25.39.3A.5.2A.5.4 |
| PM-30 | Supply Chain Risk Management Strategy | 4.46.27.5 |
| PM-31 | Continuous Monitoring Strategy | 4.46.27.47.59.19.210.110.2 |
| PM-32 | Purposing | 4.1A.7.14 |
PS Personnel Security
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| PS-01 | Policy and Procedures | 5.25.37.5A.5.1A.5.2A.5.4A.5.31A.5.36A.5.37 |
| PS-03 | Personnel Screening | A.6.1 |
| PS-04 | Personnel Termination | A.5.11A.6.5 |
| PS-05 | Personnel Transfer | A.5.11A.6.5 |
| PS-06 | Access Agreements | A.5.4A.5.14A.6.2A.6.6 |
| PS-07 | External Personnel Security | A.5.2A.5.4 |
| PS-08 | Personnel Sanctions | 7.3A.6.4 |
| PS-09 | Position Descriptions | 5.3A.5.2A.6.2 |
PT Personally Identifiable Information Processing and Transparency
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| PT-01 | Policy and Procedures | A.5.1A.5.34 |
| PT-02 | Authority to Process Personally Identifiable Information | A.5.34 |
| PT-03 | Personally Identifiable Information Processing Purposes | A.5.34 |
| PT-04 | Consent | A.5.34 |
| PT-05 | Privacy Notice | A.5.34 |
| PT-06 | System of Records Notice | A.5.34A.8.11 |
| PT-07 | Specific Categories of Personally Identifiable Information | A.5.34A.8.11 |
| PT-08 | Computer Matching Requirements | A.5.34 |
RA Risk Assessment
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| RA-01 | Policy and Procedures | 5.25.36.17.5A.5.1A.5.2A.5.4A.5.31A.5.36A.5.37 |
| RA-02 | Security Categorization | 6.1A.5.12A.5.13 |
| RA-03 | Risk Assessment | 4.16.16.1.38.28.39.3A.5.7A.8.8 |
| RA-05 | Vulnerability Monitoring and Scanning | 8.2A.5.7A.8.8 |
| RA-07 | Risk Response | 6.16.1.38.310.2 |
| RA-09 | Criticality Analysis | 8.2A.5.22 |
| RA-10 | Threat Hunting | A.5.7 |
SA System and Services Acquisition
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| SA-01 | Policy and Procedures | 5.25.37.58.1A.5.1A.5.2A.5.4A.5.23A.5.31A.5.36A.5.37 |
| SA-02 | Allocation of Resources | 7.1 |
| SA-03 | System Development Life Cycle | 7.1A.5.2A.5.8A.8.25A.8.31 |
| SA-04 | Acquisition Process | 8.1A.5.8A.5.19A.5.20A.5.23A.5.31A.8.26A.8.29A.8.30 |
| SA-05 | System Documentation | 7.5A.5.37 |
| SA-08 | Security and Privacy Engineering Principles | A.8.25A.8.26A.8.27A.8.28 |
| SA-09 | External System Services | A.5.2A.5.4A.5.8A.5.14A.5.19A.5.20A.5.22A.5.23A.8.21A.8.30 |
| SA-10 | Developer Configuration Management | 6.3A.8.4A.8.9A.8.25A.8.28A.8.30A.8.32 |
| SA-11 | Developer Testing and Evaluation | A.8.25A.8.28A.8.29A.8.30A.8.31A.8.33 |
| SA-15 | Development Process, Standards, and Tools | A.5.8A.8.25A.8.28A.8.30A.8.33 |
| SA-16 | Developer-provided Training | A.8.28 |
| SA-17 | Developer Security and Privacy Architecture and Design | A.8.25A.8.27A.8.28 |
| SA-21 | Developer Screening | A.6.1 |
| SA-22 | Unsupported System Components | A.8.19 |
SC System and Communications Protection
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| SC-01 | Policy and Procedures | 5.25.37.5A.5.1A.5.2A.5.4A.5.31A.5.36A.5.37 |
| SC-05 | Denial-of-service Protection | A.8.6 |
| SC-06 | Resource Availability | A.8.6 |
| SC-07 | Boundary Protection | A.5.14A.5.23A.8.12A.8.16A.8.20A.8.21A.8.22A.8.23A.8.27 |
| SC-08 | Transmission Confidentiality and Integrity | A.5.10A.5.14A.5.33A.8.20A.8.21A.8.26 |
| SC-10 | Network Disconnect | A.8.20 |
| SC-12 | Cryptographic Key Establishment and Management | A.5.14A.8.24 |
| SC-13 | Cryptographic Protection | A.8.24A.8.26 |
| SC-15 | Collaborative Computing Devices and Applications | A.5.14 |
| SC-17 | Public Key Infrastructure Certificates | A.8.24 |
| SC-28 | Protection of Information at Rest | A.5.10A.5.33A.7.9A.8.1A.8.24 |
| SC-32 | System Partitioning | A.8.22A.8.27A.8.31 |
SI System and Information Integrity
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| SI-01 | Policy and Procedures | 5.25.37.5A.5.1A.5.2A.5.4A.5.31A.5.36A.5.37 |
| SI-02 | Flaw Remediation | A.6.8A.8.8A.8.32 |
| SI-03 | Malicious Code Protection | A.8.7A.8.23 |
| SI-04 | System Monitoring | 9.1A.8.12A.8.16 |
| SI-05 | Security Alerts, Advisories, and Directives | A.5.6A.5.7A.8.8 |
| SI-08 | Spam Protection | A.8.7 |
| SI-12 | Information Management and Retention | A.5.33A.8.10 |
| SI-19 | De-identification | A.8.11 |
| SI-20 | Tainting | A.8.12 |
| SI-21 | Information Refresh | A.8.10 |
SR Supply Chain Risk Management
| Control | Name | ISO 27001:2022 References |
|---|---|---|
| SR-01 | Policy and Procedures | 4.25.25.37.5A.5.1A.5.2A.5.4A.5.19A.5.21A.5.31A.5.36A.5.37 |
| SR-02 | Supply Chain Risk Management Plan | 4.2A.5.19A.5.20A.5.21A.8.30 |
| SR-03 | Supply Chain Controls and Processes | 4.2A.5.19A.5.20A.5.21 |
| SR-04 | Provenance | A.5.21A.8.30 |
| SR-05 | Acquisition Strategies, Tools, and Methods | A.5.20A.5.21A.5.23 |
| SR-06 | Supplier Assessments and Reviews | A.5.21A.5.22 |
| SR-07 | Supply Chain Operations Security | A.5.22 |
| SR-11 | Component Authenticity | A.5.21 |
| SR-12 | Component Disposal | A.8.10 |