ISO 27002 Annex B

Annex B

ISO 27002 Annex B primarily provides a cross-reference between the 2022 version of ISO 27002 and the previous 2013 version. This annex is designed to make it easier for organizations to transition from the older controls to the updated ones, offering a clear comparison of control numbers and descriptions.

Preview Of Iso 27002 Annex B

Cross-Reference table

This annex provides a detailed cross-reference table that maps the old control numbers and descriptions from the 2013 standard to their updated counterparts in the 2022 version.

114 Controls -> 93 Controls

The 2022 revision of ISO 27002 introduced significant changes, including reducing the total number of controls from 114 to 93, merging some controls, and introducing new ones. Annex B ensures that organizations familiar with the older controls can easily align their security measures with the updated controls, minimizing disruption while maintaining compliance

2022 Structure

The primary aim of this ISO 27002 annex B is to simplify the transition for organizations that already follow the 2013 framework. By providing a clear comparison, Annex B helps businesses ensure that they have implemented the correct controls under the new structure, which now categorizes controls under four main domains: Organizational, People, Physical, and Technological

ISO 27001 mapping 2022 to 2013

ISO 27002:2022ISO 27002:2013
Control IDControl NameControl ID
5.1 Policies for information security5.1.15.1.2  
5.2 Information security roles and responsibilities6.1.1   
5.3 Segregation of duties6.1.2   
5.4 Management responsibilities7.2.1   
5.5 Contact with authorities6.1.3   
5.6 Contact with special interest groups6.1.4   
5.7 Threat intelligenceNEW   
5.8 Information security in project management6.1.514.1.1  
5.9 Inventory of information and other associated assets8.1.18.1.2  
5.10 Acceptable use of information and other associated assets8.1.38.2.3  
5.11 Return of assets8.1.4   
5.12 Classification of information8.2.1   
5.13 Labelling of information8.2.2   
5.14 Information transfer13.2.113.2.213.2.3 
5.15 Access control9.1.19.1.2  
5.16 Identity management9.2.1   
5.17 Authentication information9.2.49.3.19.4.3 
5.18 Access rights9.2.29.2.59.2.6 
5.19 Information security in supplier relationships15.1.1   
5.20 Addressing information security within supplier agreements15.1.2   
5.21 Managing information security in the ICT supply chain15.1.3   
5.22 Monitoring, review and change management of supplier services15.2.115.2.2  
5.23 Information security for use of cloud servicesNEW   
5.24 Information security incident management planning and preparation16.1.1   
5.25 Assessment and decision on information security events16.1.4   
5.26 Response to information security incidents16.1.5   
5.27 Learning from information security incidents16.1.6   
5.28 Collection of evidence16.1.7   
5.29 Information security during disruption17.1.117.1.217.1.3 
5.30 ICT readiness for business continuityNEW   
5.31 Legal, statutory, regulatory and contractual requirements18.1.118.1.5  
5.32 Intellectual property rights18.1.2   
5.33 Protection of records18.1.3   
5.34 Privacy and protection of PII18.1.4   
5.35 Independent review of information security18.2.1   
5.36 Compliance with policies, rules and standards for information security18.2.218.2.3  
5.37 Documented operating procedures12.1.1   
6.1 Screening7.1.1   
6.2 Terms and conditions of employment7.1.2   
6.3 Information security awareness, education and training7.2.2   
6.4 Disciplinary process7.2.3   
6.5 Responsibilities after termination or change of employment7.3.1   
6.6 Confidentiality or non-disclosure agreements13.2.4   
6.7 Remote working6.2.2   
6.8 Information security event reporting16.1.216.1.3  
7.1 Physical security perimeters11.1.1   
7.2 Physical entry11.1.211.1.6  
7.3 Securing offices, rooms and facilities11.1.3   
7.4 Physical security monitoringNEW   
7.5 Protecting against physical and environmental threats11.1.4   
7.6 Working in secure areas11.1.5   
7.7 Clear desk and clear screen11.2.9   
7.8 Equipment siting and protection11.2.1   
7.9 Security of assets off-premises11.2.6   
7.10 Storage media8.3.18.3.28.3.311.2.5
7.11 Supporting utilities11.2.2   
7.12 Cabling security11.2.3   
7.13 Equipment maintenance11.2.4   
7.14 Secure disposal or re-use of equipment11.2.7   
8.1 User endpoint devices6.2.111.2.8  
8.2 Privileged access rights9.2.3   
8.3 Information access restriction9.4.1   
8.4 Access to source code9.4.5   
8.5 Secure authentication9.4.2   
8.6 Capacity management12.1.3   
8.7 Protection against malware12.2.1   
8.8 Management of technical vulnerabilities12.6.118.2.3  
8.9 Configuration managementNEW   
8.10 Information deletionNEW   
8.11 Data maskingNEW   
8.12 Data leakage preventionNEW   
8.13 Information backup12.3.1   
8.14 Redundancy of information processing facilities17.2.1   
8.15 Logging12.4.112.4.212.4.3 
8.16 Monitoring activitiesNEW   
8.17 Clock synchronization12.4.4   
8.18 Use of privileged utility programs9.4.4   
8.19 Installation of software on operational systems12.5.112.6.2  
8.20 Networks security13.1.1   
8.21 Security of network services13.1.2   
8.22 Segregation of networks13.1.3   
8.23 Web filteringNEW   
8.24 Use of cryptography10.1.110.1.2  
8.25 Secure development life cycle14.2.1   
8.26 Application security requirements14.1.214.1.3  
8.27 Secure system architecture and engineering principles14.2.5   
8.28 Secure codingNEW   
8.29 Security testing in development and acceptance14.2.814.2.9  
8.30 Outsourced development14.2.7   
8.31 Separation of development, test and production environments12.1.414.2.6  
8.32 Change management12.1.214.2.214.2.314.2.4
8.33 Test information14.3.1   
8.34 Protection of information systems during audit testing12.7.1   

ISO 27001 mapping 2013 to 2022

ISO 27002:2013 ISO 27002:2022
Control IDControl NameControl ID
5.1.1 Policies for Information Security5,1 
5.1.2 Review of the Policies for Information Security5,1 
6.1.1 Information Security Roles and Responsibilities5,2 
6.1.2 Segregation of Duties5,3 
6.1.3 Contact with Authorities5,5 
6.1.4 Contact with Special Interest Groups5,6 
6.1.5 Information Security in Project Management5,8 
6.2.1 Mobile Device Policy8,1 
6.2.2 Teleworking6,7 
7.1.1 Screening6,1 
7.1.2 Terms and Conditions of Employment6,2 
7.2.1 Management Responsibilities5,4 
7.2.2 Information Security Awareness, Education and Training6,3 
7.2.3 Disciplinary Process6,4 
7.3.1 Termination or Change of Employment Responsibilities6,5 
8.1.1 Inventory of Assets5,9 
8.1.2 Ownership of Assets5,9 
8.1.3 Acceptable Use of Assets5,1 
8.1.4 Return of Assets5,11 
8.2.1 Classification of Information5,12 
8.2.2  Labelling of Information5,13 
8.2.3  Handling of Assets5.10 
8.3.1  Management of Removable Media7.10 
8.3.2  Disposal of Media7.10 
8.3.3  Physical Media Transfer7.10 
9.1.1  Access Control Policy5.15 
9.1.2 Access to Networks and Network Services5.15 
9.2.1 User Registration and De-registration5.16 
9.2.2 User Access Provisioning5.18 
9.2.3 Management of Privileged Access Rights8.2 
9.2.4 Management of Secret Authentication Information of Users5.17 
9.2.5 Review of User Access Rights5.18 
9.2.6 Removal or Adjustment of Access Rights5.18 
9.3.1 Use of Secret Authentication Information5.17 
9.4.1 Information Access Restriction8.3 
9.4.2 Secure Log-on Procedures8.5 
9.4.3 Password Management System5.17 
9.4.4 Use of Privileged Utility Programs8.18 
9.4.5 Access Control to Program Source Code8.4 
10.1.1 Policy on the Use of Cryptographic Controls8.24 
10.1.2 Key Management8.24 
11.1.1 Physical Security Perimeter 7.1 
11.1.2 Physical Entry Controls 7.2 
11.1.3 Securing Offices, Rooms and Facilities7.3 
11.1.4 Protecting Against External and Environmental Threats7.5 
11.1.5 Working in Secure Areas7.6 
11.1.6 Delivery and Loading Areas7.1 
11.2.1 Equipment Siting and Protection7.8 
11.2.2 Supporting Utilities7.11 
11.2.3 Cabling Security7.12 
11.2.4 Equipment Maintenance7.13 
11.2.5 Removal of Assets7.10 
11.2.6 Security of Equipment and Assets Off-Premises7.9 
11.2.7 Secure Disposal or Re-Use of Equipment7.14 
11.2.8 Unattended User Equipment8.1 
11.2.9 Clear Desk and Clear Screen Policy7.7 
12.1.1 Documented Operating Procedures5.37 
12.1.2 Change Management8.32 
12.1.3 Capacity Management8.6 
12.1.4 Separation of Development, Testing and Operational Environments8.31 
12.2.1 Controls Against Malware8.7 
12.3.1 Information Backup8.13 
12.4.1 Event Logging8.15 
12.4.2 Protection of Log Information8.15 
12.4.3 Administrator and Operator Logs8.15 
12.4.4 Clock Synchronization8.17 
12.5.1 Installation of Software on Operational Systems8.19 
12.6.1 Management of Technical Vulnerabilities8.8 
12.6.2 Restrictions on Software Installation8.19 
12.7.1 Information Systems Audit Controls8.34 
13.1.1 Network Controls8.20 
13.1.2 Security of Network Services8.21 
13.1.3 Segregation of Networks8.22 
13.2.1 Information Transfer Policies and Procedures5.14 
13.2.2 Agreements on Information Transfer5.14 
13.2.3 Electronic Messaging5.14 
13.2.4 Confidentiality or Non-Disclosure Agreements6.6 
14.1.1 Information Security Requirements Analysis and Specification5.8 
14.1.2 Securing Application Services on Public Networks8.26 
14.1.3 Protecting Application Services Transactions8.26 
14.2.1 Secure Development Policy8.25 
14.2.2 System Change Control Procedures8.32 
14.2.3 Technical Review of Applications After Operating Platform Changes8.32 
14.2.4 Restrictions on Changes to Software Packages8.32 
14.2.5 Secure System Engineering Principles8.27 
14.2.6 Secure Development Environment8.31 
14.2.7 Outsourced Development8.30 
14.2.8 System Security Testing8.29 
14.2.9 System Acceptance Testing8.29 
14.3.1 Protection of Test Data8.33 
15.1.1 Information Security Policy for Supplier Relationships5.19 
15.1.2 Addressing Security Within Supplier Agreements5.20 
15.1.3 Information and Communication Technology Supply Chain5.21 
15.2.1 Monitoring and Review of Supplier Services5.22 
15.2.2 Managing Changes to Supplier Services5.22 
16.1.1 Responsibilities and Procedures5.24 
16.1.2 Reporting Information Security Events6.8 
16.1.3 Reporting Information Security Weaknesses6.8 
16.1.4 Assessment of and Decision on Information Security Events5.25 
16.1.5 Response to Information Security Incidents5.26 
16.1.6 Learning from Information Security Incidents5.27 
16.1.7 Collection of Evidence5.28 
17.1.1 Planning Information Security Continuity5.29 
17.1.2 Implementing Information Security Continuity5.29 
17.1.3 Verify, Review and Evaluate Information Security Continuity5.29 
17.2.1 Availability of Information Processing Facilities8.14 
18.1.1 Identification of Applicable Legislation and Contractual Requirements5.31 
18.1.2 Intellectual Property Rights5.32 
18.1.3 Protection of Records5.33 
18.1.4 Privacy and Protection of Personally Identifiable Information5.34 
18.1.5 Regulation of Cryptographic Controls5.31 
18.2.1 Independent Review of Information Security5.35 
18.2.2 Compliance with Security Policies and Standards5.36 
18.2.3 Technical Compliance Review5.368,8