Information security, cybersecurity and privacy protection — Information security controls

This document provides a reference set of generic information security controls including implementation guidance. This document is designed to be used by organizations: a) within the context of an information security management system (ISMS) based on ISO/IEC27001; b) for implementing information security controls based on internationally recognized best practices; c) for developing organization-specific information security management guidelines.

Sécurité de l'information, cybersécurité et protection de la vie privée — Mesures de sécurité de l'information

Informacijska varnost, kibernetska varnost in varovanje zasebnosti - Kontrole informacijske varnosti

General Information

Status
Published
Publication Date
14-Feb-2022
Current Stage
5060 - Close of voting Proof returned by Secretariat
Completion Date
17-Dec-2021

RELATIONS

Buy Standard

Standard
ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls Released:3/23/2022
English language
152 pages
sale 15% off
Preview
sale 15% off
Preview
Standard
REDLINE ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls Released:3/23/2022
English language
152 pages
sale 15% off
Preview
sale 15% off
Preview
Draft
ISO/IEC FDIS 27002 - Information security, cybersecurity and privacy protection -- Information security controls
English language
151 pages
sale 15% off
Preview
sale 15% off
Preview

Standards Content (sample)

INTERNATIONAL ISO/IEC
STANDARD 27002
Third edition
2022-02
Corrected version
2022-03
Information security, cybersecurity
and privacy protection — Information
security controls
Sécurité de l'information, cybersécurité et protection de la vie
privée — Mesures de sécurité de l'information
Reference number
ISO/IEC 27002:2022(E)
© ISO/IEC 2022
---------------------- Page: 1 ----------------------
ISO/IEC 27002:2022(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2022

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on

the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below

or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2022 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC 27002:2022(E)
Contents Page

Foreword ....................................................................................................................................................................................................................................... vi

Introduction .............................................................................................................................................................................................................................vii

1 Scope ................................................................................................................................................................................................................................. 1

2 Normative references ..................................................................................................................................................................................... 1

3 Terms, definitions and abbreviated terms .............................................................................................................................. 1

3.1 Terms and definitions ...................................................................................................................................................................... 1

3.2 Abbreviated terms .............................................................................................................................................................................. 6

4 Structure of this document .......................................................................................................................................................................7

4.1 Clauses ........................................................................................................................................................................................................... 7

4.2 Themes and attributes .................................................................................................................................................................... 8

4.3 Control layout .......................................................................................................................................................................................... 9

5 Organizational controls ............................................................................................................................................................................... 9

5.1 Policies for information security ........................................................................................................................................... . 9

5.2 Information security roles and responsibilities .................................................................................................... 11

5.3 Segregation of duties...................................................................................................................................................................... 12

5.4 Management responsibilities .................................................................................................................................................13

5.5 Contact with authorities ............................................................................................................................................................. 14

5.6 Contact with special interest groups ............................................................................................................................... 15

5.7 Threat intelligence ...........................................................................................................................................................................15

5.8 Information security in project management ......................................................................................................... 17

5.9 Inventory of information and other associated assets .................................................................................... 18

5.10 Acceptable use of information and other associated assets ....................................................................... 20

5.11 Return of assets .................................................................................................................................................................................. 21

5.12 Classification of information ................................................................................................................................................... 22

5.13 Labelling of information .............................................................................................................................................................23

5.14 Information transfer ...................................................................................................................................................................... 24

5.15 Access control ....................................................................................................................................................................................... 27

5.16 Identity management ..................................................................................................................................................................... 29

5.17 Authentication information ..................................................................................................................................................... 30

5.18 Access rights .......................................................................................................................................................................................... 32

5.19 Information security in supplier relationships ...................................................................................................... 33

5.20 Addressing information security within supplier agreements ............................................................... 35

5.21 Managing information security in the ICT supply chain ................................................................................ 37

5.22 Monitoring, review and change management of supplier services ......................................................39

5.23 Information security for use of cloud services ....................................................................................................... 41

5.24 Information security incident management planning and preparation .......................................... 43

5.25 Assessment and decision on information security events ........................................................................... 45

5.26 Response to information security incidents ............................................................................................................. 45

5.27 Learning from information security incidents .......................................................................................................46

5.28 Collection of evidence ........................................................................................................................................... ......................... 47

5.29 Information security during disruption .......................................................................................................................48

5.30 ICT readiness for business continuity ............................................................................................................................48

5.31 Legal, statutory, regulatory and contractual requirements .......................................................................50

5.32 Intellectual property rights ..................................................................................................................................................... 51

5.33 Protection of records ..................................................................................................................................................................... 53

5.34 Privacy and protection of PII ..................................................................................................................................................54

5.35 Independent review of information security ........................................................................................................... 55

5.36 Compliance with policies, rules and standards for information security ......................................56

5.37 Documented operating procedures .................................................................................................................................. 57

6 People controls ...................................................................................................................................................................................................58

6.1 Screening ..................................................................................................................................................................................................58

6.2 Terms and conditions of employment ............................................................................................................................. 59

iii
© ISO/IEC 2022 – All rights reserved
---------------------- Page: 3 ----------------------
ISO/IEC 27002:2022(E)

6.3 Information security awareness, education and training ............................................................................60

6.4 Disciplinary process ....................................................................................................................................................................... 62

6.5 Responsibilities after termination or change of employment...................................................................63

6.6 Confidentiality or non-disclosure agreements .......................................................................................................63

6.7 Remote working .................................................................................................................................................................................65

6.8 Information security event reporting.............................................................................................................................66

7 Physical controls ...............................................................................................................................................................................................67

7.1 Physical security perimeters .................................................................................................................................................. 67

7.2 Physical entry .......................................................................................................................................................................................68

7.3 Securing offices, rooms and facilities ............................................................................................................................. 70

7.4 Physical security monitoring ........................................................................................................................................... ....... 70

7.5 Protecting against physical and environmental threats ............................................................................... 71

7.6 Working in secure areas .............................................................................................................................................................72

7.7 Clear desk and clear screen ......................................................................................................................................................73

7.8 Equipment siting and protection .........................................................................................................................................74

7.9 Security of assets off-premises .............................................................................................................................................75

7.10 Storage media ....................................................................................................................................................................................... 76

7.11 Supporting utilities ..........................................................................................................................................................................77

7.12 Cabling security .................................................................................................................................................................................. 78

7.13 Equipment maintenance .............................................................................................................................................................79

7.14 Secure disposal or re-use of equipment ........................................................................................................................80

8 Technological controls ...............................................................................................................................................................................81

8.1 User endpoint devices ................................................................................................................................................................... 81

8.2 Privileged access rights ...............................................................................................................................................................83

8.3 Information access restriction ..............................................................................................................................................84

8.4 Access to source code ....................................................................................................................................................................86

8.5 Secure authentication ...................................................................................................................................................................87

8.6 Capacity management ...................................................................................................................................................................89

8.7 Protection against malware ....................................................................................................................................................90

8.8 Management of technical vulnerabilities ..................................................................................................................... 92

8.9 Configuration management ..................................................................................................................................................... 95

8.10 Information deletion ...................................................................................................................................................................... 97

8.11 Data masking ........................................................................................................................................................................................98

8.12 Data leakage prevention ..........................................................................................................................................................100

8.13 Information backup......................................................................................................................................................................101

8.14 Redundancy of information processing facilities ..............................................................................................102

8.15 Logging ....................................................................................................................................................................................................103

8.16 Monitoring activities ...................................................................................................................................................................106

8.17 Clock synchronization ...............................................................................................................................................................108

8.18 Use of privileged utility programs ..................................................................................................................................109

8.19 Installation of software on operational systems ............................................................................................... 110

8.20 Networks security ......................................................................................................................................................................... 111

8.21 Security of network services ...............................................................................................................................................112

8.22 Segregation of networks ..........................................................................................................................................................113

8.23 Web filtering ....................................................................................................................................................................................... 114

8.24 Use of cryptography ....................................................................................................................................................................115

8.25 Secure development life cycle ............................................................................................................................................. 117

8.26 Application security requirements ................................................................................................................................ 118

8.27 Secure system architecture and engineering principles ............................................................................120

8.28 Secure coding.....................................................................................................................................................................................122

8.29 Security testing in development and acceptance ..............................................................................................124

8.30 Outsourced development ........................................................................................................................................................126

8.31 Separation of development, test and production environments..........................................................127

8.32 Change management ...................................................................................................................................................................128

8.33 Test information ..............................................................................................................................................................................129

8.34 Protection of information systems during audit testing ............................................................................130

Annex A (informative) Using attributes .................................................................................................................................................... 132

© ISO/IEC 2022 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/IEC 27002:2022(E)

Annex B (informative) Correspondence of ISO/IEC 27002:2022 (this document) with ISO/

IEC 27002:2013 ............................................................................................................................................................................................... 143

Bibliography ......................................................................................................................................................................................................................... 150

© ISO/IEC 2022 – All rights reserved
---------------------- Page: 5 ----------------------
ISO/IEC 27002:2022(E)
Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical

Commission) form the specialized system for worldwide standardization. National bodies that are

members of ISO or IEC participate in the development of International Standards through technical

committees established by the respective organization to deal with particular fields of technical

activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international

organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the

work.

The procedures used to develop this document and those intended for its further maintenance

are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria

needed for the different types of document should be noted. This document was drafted in

accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or

www.iec.ch/members_experts/refdocs).

Attention is drawn to the possibility that some of the elements of this document may be the subject

of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent

rights. Details of any patent rights identified during the development of the document will be in the

Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents) or the IEC

list of patent declarations received (see patents.iec.ch).

Any trade name used in this document is information given for the convenience of users and does not

constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO’s adherence to

the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see

www.iso.org/iso/foreword.html. In the IEC, see www.iec.ch/understanding-standards.

’This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,

Subcommittee SC 27, Information security, cybersecurity and privacy protection.

This third edition cancels and replaces the second edition (ISO/IEC 27002:2013), which has been

technically revised. It also incorporates the Technical Corrigenda ISO/IEC 27002:2013/Cor. 1:2014 and

ISO/IEC 27002:2013/Cor. 2:2015.
The main changes are as follows:
— the title has been modified;

— the structure of the document has been changed, presenting the controls using a simple taxonomy

and associated attributes;

— some controls have been merged, some deleted and several new controls have been introduced. The

complete correspondence can be found in Annex B.

This corrected version of ISO/IEC 27002:2022 incorporates the following corrections:

— non-functioning hyperlinks throughout the document have been restored;

— in the introductory table in subclause 5.22 and in Table A.1 (row 5.22), "#information_security_

assurance" has been moved from the column headed "Security domains" to the column headed

"Operational capabilities".

Any feedback or questions on this document should be directed to the user’s national standards

body. A complete listing of these bodies can be found at www.iso.org/members.html and

www.iec.ch/national-committees.
© ISO/IEC 2022 – All rights reserved
---------------------- Page: 6 ----------------------
ISO/IEC 27002:2022(E)
Introduction
0.1 Background and context

This document is designed for organizations of all types and sizes. It is to be used as a reference for

determining and implementing controls for information security risk treatment in an information

security management system (ISMS) based on ISO/IEC 27001. It can also be used as a guidance

document for organizations determining and implementing commonly accepted information security

controls. Furthermore, this document is intended for use in developing industry and organization-

specific information security management guidelines, taking into consideration their specific

information security risk environment(s). Organizational or environment-specific controls other than

those included in this document can be determined through risk assessment as necessary.

Organizations of all types and sizes (including public and private sector, commercial and non-profit)

create, collect, process, store, transmit and dispose of information in many forms, including electronic,

physical and verbal (e.g. conversations and presentations).

The value of information goes beyond written words, numbers and images: knowledge, concepts, ideas

and brands are examples of intangible forms of information. In an interconnected world, information

and other associated assets deserve or require protection against various risk sources, whether natural,

accidental or deliberate.

Information security is achieved by implementing a suitable set of controls, including policies, rules,

processes, procedures, organizational structures and software and hardware functions. To meet its

specific security and business objectives, the organization should define, implement, monitor, review

and improve these controls where necessary. An ISMS such as that specified in ISO/IEC 27001 takes a

holistic, coordinated view of the organization’s information security risks in order to determine and

implement a comprehensive suite of information security controls within the overall framework of a

coherent management system.

Many information systems, including their management and operations, have not been designed to be

secure in terms of an ISMS as specified in ISO/IEC 27001 and this document. The level of security that

can be achieved only through technological measures is limited and should be supported by appropriate

management activities and organizational processes. Identifying which controls should be in place

requires careful planning and attention to detail while carrying out risk treatment.

A successful ISMS requires support from all personnel in the organization. It can also require

participation from other interested parties, such as shareholders or suppliers. Advice from subject

matter experts can also be needed.

A suitable, adequate and effective information security management system provides assurance to the

organization’s management and other interested parties that their information and other associated

assets are kept reasonably secure and protected against threats and harm, thereby enabling the

organization to achieve the stated business objectives.
0.2 Information security requirements

It is essential that an organization determines its information security requirements. There are three

main sources of information security requirements:

a) the assessment of risks to the organization, taking into account the organization’s overall business

strategy and objectives. This can be facilitated or supported through an information security-

specific risk assessment. This should result in the determination of the controls necessary to

ensure that the residual risk to the organization meets its risk acceptance criteria;

b) the legal, statutory, regulatory and contractual requirements that an organization and its

interested parties (trading partners, service providers, etc.) have to comply with and their socio-

cultural environment;
vii
© ISO/IEC 2022 – All rights reserved
---------------------- Page: 7 ----------------------
ISO/IEC 27002:2022(E)

c) the set of principles, objectives and business requirements for all the steps of the life cycle of

information that an organization has developed to support its operations.
0.3 Controls

A control is defined as a measure that modifies or maintains risk. Some of the controls in this document

are controls that modify risk, while others maintain risk. An information security policy, for example,

can only maintain risk, whereas compliance with the information security policy can modify risk.

Moreover, some controls describe the same generic measure in different risk contexts. This document

provides a generic mixture of organizational, people, physi
...

INTERNATIONAL ISO/IEC
STANDARD 27002
Redline version
compares Third edition to
Second edition
Information security, cybersecurity
and privacy protection — Information
security controls
Sécurité de l'information, cybersécurité et protection de la vie
privée — Mesures de sécurité de l'information
Reference number
ISO/IEC 27002:r edline:2022(E)
© ISO/IEC 2022
---------------------- Page: 1 ----------------------
ISO/IEC 27002:redline:2022(E)
IMPORTANT — PLEASE NOTE
This is a provisional mark-up copy and uses the following colour coding:
Text example 1 — indicates added text (in green)
— indicates removed text (in red)
Text example 2
— indicates added graphic figure
— indicates removed graphic figure
1.x ... — Heading numbers containg modifications are highlighted in yellow in
the Table of Contents

All changes in this document have yet to reach concensus by vote and as such should only

be used internally for review purposes.
DISCLAIMER

This Redline version is not an official IEC Standard and is intended only to provide the

user with an indication of what changes have been made to the previous version. Only the

current version of the standard is to be considered the official document.

This Redline version provides you with a quick and easy way to compare all the changes

between this standard and its previous edition. A vertical bar appears in the margin

wherever a change has been made. Additions and deletions are displayed in red, with

deletions being struck through.
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2022

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on

the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below

or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2022 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC 27002:redline:2022(E)
Contents Page

Foreword ....................................................................................................................................................................................................................................viii

0  Introduction ..........................................................................................................................................................................................................................ix

1 Scope ................................................................................................................................................................................................................................. 1

2 Normative references ..................................................................................................................................................................................... 1

3 Terms and definitions , definitions and abbreviated terms................................................................................... 1

3.1 Terms and definitions ...................................................................................................................................................................... 1

3.2 Abbreviated terms .............................................................................................................................................................................. 6

4 Structure of this standard document ............................................................................................................................................. 8

4.1 Clauses ........................................................................................................................................................................................................... 8

4.2 Control categories Themes and attributes ..................................................................................................................... 8

4.3 Control layout ....................................................................................................................................................................................... 10

5 Information security policies ..............................................................................................................................................................10

5.1 Management direction for information security .................................................................................................. 10

5.1.1 Policies for information security ...................................................................................................................... 10

5.1.2 Review of the policies for information security .................................................................................. 11

6 Organization of information security ..................................................................................................12

6.1 Internal organization ...................................................................................................................................... 12

6.1.1 Information security roles and responsibilities .................................................................. 12

6.1.2 Segregation of duties ........................................................................................................................ 13

6.1.3 Contact with authorities ................................................................................................................. 13

6.1.4 Contact with special interest groups ........................................................................................ 13

6.1.5 Information security in project management ........................................................................14

6.2 Mobile devices and teleworking ..................................................................................................................14

6.2.1 Mobile device policy ...........................................................................................................................14

6.2.2 Teleworking .......................................................................................................................................... 16

7 Human resource security .........................................................................................................................17

7.1 Prior to employment .........................................................................................................................................17

7.1.1 Screening ................................................................................................................................................17

7.1.2 Terms and conditions of employment ............................. .......................................................... 18

7.2 During employment ......................................................................................................................................... 18

7.2.1 Management responsibilities........................................................................................................ 18

7.2.2 Information security awareness, education and training ................................................19

7.2.3 Disciplinary process ......................................................................................................................... 20

7.3 Termination and change of employment ................................................................................................ 21

7.3.1 Termination or change of employment responsibilities .............................................................. 21

8 5 Asset management Organizational controls ........................................................................................................................21

5.1 Policies for information security ............................................................................................................... 21

5.2 Information security roles and responsibilities ................................................................................. 24

5.3 Segregation of duties ....................................................................................................................................... 25

5.4 Management responsibilities .................................................................................................................. ..... 25

5.5 Contact with authorities ................................................................................................................................ 26

5.6 Contact with special interest groups ....................................................................................................... 27

5.7 Threat intelligence ............................................................................................................................................ 28

5.8 Information security in project management ...................................................................................... 29

8.1 5.9 Responsibility for Inventory of information and other associated assets ............................... 31

8.1.1 Inventory of assets ............................................................................................................................ 31

8.1.2 Ownership of assets .......................................................................................................................... 31

8.1.3 Acceptable use of assets .................................................................................................................. 32

8.1.4 Return of assets .................................................................................................................................. 32

5.10 Acceptable use of information and other associated assets .......................................................... 34

5.11 Return of assets .................................................................................................................................................................................. 35

iii
© ISO/IEC 2022 – All rights reserved
---------------------- Page: 3 ----------------------
ISO/IEC 27002:redline:2022(E)

8.2 5.12 Information classification Classification of information ............................................................... 36

8.2.1 Classification of information......................................................................................................... 36

8.2.2 Labelling of information ................................................................................................................. 37

8.2.3 Handling of assets .............................................................................................................................. 37

5.13 Labelling of information ................................................................................................................................ 39

5.14 Information transfer ........................................................................................................................................ 40

5.15 Access control ..................................................................................................................................................... 43

5.16 Identity management ...................................................................................................................................... 45

5.17 Authentication information .......................................................................................................................... 46

5.18 Access rights ........................................................................................................................................................ 48

5.19 Information security in supplier relationships ................................................................................... 49

5.20 Addressing information security within supplier agreements.....................................................51

5.21 Managing information security in the ICT supply chain ................................................................. 53

5.22 Monitoring, review and change management of supplier services ............................................ 55

5.23 Information security for use of cloud services .................................................................................... 57

5.24 Information security incident management planning and preparation .................................. 59

5.25 Assessment and decision on information security events ..............................................................61

5.26 Response to information security incidents ..........................................................................................61

5.27 Learning from information security incidents .................................................................................... 62

5.28 Collection of evidence ..................................................................................................................................... 63

5.29 Information security during disruption ................................................................................................. 64

5.30 ICT readiness for business continuity ..................................................................................................... 64

8.3 5.31 Media handling Legal, statutory, regulatory and contractual requirements ....................... 66

8.3.1 Management of removable media ............................................................................................... 66

8.3.2 Disposal of media ............................................................................................................................... 66

8.3.3 Physical media transfer ................................................................................................................... 67

5.32 Intellectual property rights.......................................................................................................................... 69

5.33 Protection of records ....................................................................................................................................... 70

5.34 Privacy and protection of PII ....................................................................................................................... 72

5.35 Independent review of information security ....................................................................................... 73

5.36 Compliance with policies, rules and standards for information security ................................74

5.37 Documented operating procedures .......................................................................................................... 75

9 Access control................................................................................................................................................76

9.1 Business requirements of access control ................................................................................................76

9.1.1 Access control policy .........................................................................................................................76

9.1.2 Access to networks and network services ............................................................................. 77

9.2 User access management ............................................................................................................................... 78

9.2.1 User registration and de-registration ...................................................................................... 78

9.2.2 User access provisioning................................................................................................................. 78

9.2.3 Management of privileged access rights ................................................................................. 79

9.2.4 Management of secret authentication information of users .......................................... 80

9.2.5 Review of user access rights ......................................................................................................... 80

9.2.6 Removal or adjustment of access rights .................................................................................. 81

9.3 User responsibilities ........................................................................................................................................ 81

9.3.1 Use of secret authentication information................................................................................ 81

9.4 System and application access control .................................................................................................... 82

9.4.1 Information access restriction ..................................................................................................... 82

9.4.2 Secure log-on procedures ............................................................................................................... 83

9.4.3 Password management system ................................................................................................... 84

9.4.4 Use of privileged utility programs ............................................................................................. 84

9.4.5 Access control to program source code ................................................................................... 85

10 6 Cryptography People controls .................................................................................................................85

6.1 Screening .............................................................................................................................................................. 85

6.2 Terms and conditions of employment ...................................................................................................... 87

6.3 Information security awareness, education and training .............................................................. 88

6.4 Disciplinary process ........................................................................................................................................ 89

6.5 Responsibilities after termination or change of employment ...................................................... 90

© ISO/IEC 2022 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/IEC 27002:redline:2022(E)

6.6 Confidentiality or non-disclosure agreements .................................................................................... 91

10.1 6.7 Cryptographic controls Remote working .............................................................................................. 92

10.1.1 Policy on the use of cryptographic controls .......................................................................... 92

10.1.2 Key management ................................................................................................................................ 93

6.8 Information security event reporting...................................................................................................... 96

11 7 Physical and environmental security controls ..................................................................................97

11.1 7.1 Secure areas Physical security perimeters ........................................................................................... 97

11.1.1 Physical security perimeter .......................................................................................................... 97

11.1.2 Physical entry controls .................................................................................................................... 98

11.1.3 Securing offices, rooms and facilities ....................................................................................... 98

11.1.4 Protecting against external and environmental threats ................................................. 99

11.1.5 Working in secure areas ................................................................................................................. 99

11.1.6 Delivery and loading areas ............................................................................................................ 99

7.2 Physical entry ...................................................................................................................................................101

7.3 Securing offices, rooms and facilities ....................................................................................................102

7.4 Physical security monitoring .....................................................................................................................103

7.5 Protecting against physical and environmental threats ..............................................................104

7.6 Working in secure areas ..............................................................................................................................105

7.7 Clear desk and clear screen ........................................................................................................................106

7.8 Equipment siting and protection .............................................................................................................107

7.9 Security of assets off-premises .................................................................................................................108

7.10 Storage media ...................................................................................................................................................109

7.11 Supporting utilities ........................................................................................................................................110

7.12 Cabling security ...............................................................................................................................................111

7.13 Equipment maintenance ..............................................................................................................................112

11.2 7.14 Equipment Secure disposal or re-use of equipment .....................................................................113

11.2.1 Equipment siting and protection ..............................................................................................113

11.2.2 Supporting utilities .........................................................................................................................113

11.2.3 Cabling security ................................................................................................................................ 114

11.2.4 Equipment maintenance ...............................................................................................................114

11.2.5 Removal of assets .............................................................................................................................115

11.2.6 Security of equipment and assets off-premises .................................................................115

11.2.7 Secure disposal or re-use of equipment ................................................................................116

11.2.8 Unattended user equipment ........................................................................................................117

11.2.9 Clear desk and clear screen policy ...........................................................................................117

12 8 Operations security Technological controls .................................................................................... 119

8.1 User endpoint devices ...................................................................................................................................119

8.2 Privileged access rights .................................................................................................................. ..............121

8.3 Information access restriction ..................................................................................................................122

8.4 Access to source code ....................................................................................................................................124

8.5 Secure authentication ...................................................................................................................................125

12.1 8.6 Operational procedures and responsibilities Capacity management ....................................127

12.1.1 Documented operating procedures .........................................................................................127

12.1.2 Change management ......................................................................................................................127

12.1.3 Capacity management ....................................................................................................................128

12.1.4 Separation of development, testing and operational environments ........................129

12.2 8.7 Protection from against malware ..........................................................................................................131

12.2.1 Controls against malware ............................................................................................................131

8.8 Management of technical vulnerabilities .............................................................................................134

8.9 Configuration management ........................................................................................................................137

8.10 Information deletion ......................................................................................................................................139

8.11 Data masking ......................................................... ............................................................................................140

8.12 Data leakage prevention ..............................................................................................................................142

12.3 8.13 Backup Information backup............................................................................................................................................. 143

12.3.1 Information backup ........................................................................................................................143

8.14 Redundancy of information processing facilities .............................................................................145

12.4 8.15 Logging and monitoring  ..........................................................................................................................146

© ISO/IEC 2022 – All rights reserved
---------------------- Page: 5 ----------------------
ISO/IEC 27002:redline:2022(E)

12.4.1 Event logging ......................................................................................................................................146

12.4.2 Protection of log information ..................................................................................................... 147

12.4.3 Administrator and operator logs ..............................................................................................148

12.4.4 Clock synchronisation .................................................................................................................. ..148

8.16 Monitoring activities .....................................................................................................................................151

8.17 Clock synchronization ..................................................................................................................................153

8.18 Use of privileged utility programs ..........................................................................................................154

12.5 8.19 Control of operational software Installation of software on operational systems .......154

12.5.1 Installation of software on operational systems ...............................................................155

8.20 Networks security ..........................................................................................................................................157

8.21 Security of network services .....................................................................................................................158

8.22 Segregation of networks ..............................................................................................................................159

8.23 Web filtering ......................................................................................................................................................160

8.24 Use of cryptography .......................................................................................................................................161

8.25 Secure development life cycle ...................................................................................................................163

8.26 Application security requirements .........................................................................................................164

12.6 8.27 Technical vulnerability management Secure system architecture and
engineering princip
...

FINAL
INTERNATIONAL ISO/IEC
DRAFT
STANDARD FDIS
27002
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection — Information
Voting begins on:
2021-10-21 security controls
Voting terminates on:
Sécurité de l'information, cybersécurité et protection de la vie
2021-12-16
privée — Mesures de sécurité de l'information

IMPORTANT — Please use this updated version dated 2021-10-06, and discard any previous

version of this FDIS.
RECIPIENTS OF THIS DRAFT ARE INVITED TO
SUBMIT, WITH THEIR COMMENTS, NOTIFICATION
OF ANY RELEVANT PATENT RIGHTS OF WHICH
THEY ARE AWARE AND TO PROVIDE SUPPOR TING
DOCUMENTATION.
IN ADDITION TO THEIR EVALUATION AS
Reference number
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO-
ISO/IEC FDIS 27002:2021(E)
LOGICAL, COMMERCIAL AND USER PURPOSES,
DRAFT INTERNATIONAL STANDARDS MAY ON
OCCASION HAVE TO BE CONSIDERED IN THE
LIGHT OF THEIR POTENTIAL TO BECOME STAN-
DARDS TO WHICH REFERENCE MAY BE MADE IN
NATIONAL REGULATIONS. © ISO/IEC 2021
---------------------- Page: 1 ----------------------
ISO/IEC FDIS 27002:2021(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2021

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on

the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below

or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2021 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC FDIS 27002:2021(E)
Contents Page

Foreword ....................................................................................................................................................................................................................................... vi

Introduction .............................................................................................................................................................................................................................vii

1 Scope ................................................................................................................................................................................................................................. 1

2 Normative references ..................................................................................................................................................................................... 1

3 Terms, definitions and abbreviated terms .............................................................................................................................. 1

3.1 Terms and definitions ...................................................................................................................................................................... 1

3.2 Abbreviated terms .............................................................................................................................................................................. 6

4 Structure of this document .......................................................................................................................................................................7

4.1 Clauses ........................................................................................................................................................................................................... 7

4.2 Themes and attributes .................................................................................................................................................................... 7

4.3 Control layout .......................................................................................................................................................................................... 8

5 Organizational controls ............................................................................................................................................................................... 9

5.1 Policies for information security ........................................................................................................................................... . 9

5.2 Information security roles and responsibilities .................................................................................................... 11

5.3 Segregation of duties...................................................................................................................................................................... 12

5.4 Management responsibilities .................................................................................................................................................13

5.5 Contact with authorities ............................................................................................................................................................. 14

5.6 Contact with special interest groups ............................................................................................................................... 14

5.7 Threat intelligence ...........................................................................................................................................................................15

5.8 Information security in project management ......................................................................................................... 16

5.9 Inventory of information and other associated assets .................................................................................... 18

5.10 Acceptable use of information and other associated assets ....................................................................... 20

5.11 Return of assets .................................................................................................................................................................................. 21

5.12 Classification of information ................................................................................................................................................... 21

5.13 Labelling of information .............................................................................................................................................................23

5.14 Information transfer ...................................................................................................................................................................... 24

5.15 Access control ....................................................................................................................................................................................... 26

5.16 Identity management .....................................................................................................................................................................28

5.17 Authentication information .....................................................................................................................................................29

5.18 Access rights .......................................................................................................................................................................................... 31

5.19 Information security in supplier relationships ...................................................................................................... 33

5.20 Addressing information security within supplier agreements ............................................................... 35

5.21 Managing information security in the ICT supply chain ................................................................................ 37

5.22 Monitoring, review and change management of supplier services ......................................................39

5.23 Information security for use of cloud services .......................................................................................................40

5.24 Information security incident management planning and preparation .......................................... 42

5.25 Assessment and decision on information security events ...........................................................................44

5.26 Response to information security incidents ............................................................................................................. 45

5.27 Learning from information security incidents ....................................................................................................... 45

5.28 Collection of evidence ........................................................................................................................................... .........................46

5.29 Information security during disruption ....................................................................................................................... 47

5.30 ICT readiness for business continuity ............................................................................................................................48

5.31 Legal, statutory, regulatory and contractual requirements .......................................................................49

5.32 Intellectual property rights ..................................................................................................................................................... 51

5.33 Protection of records ..................................................................................................................................................................... 52

5.34 Privacy and protection of PII ..................................................................................................................................................53

5.35 Independent review of information security ...........................................................................................................54

5.36 Conformance with policies, rules and standards for information security ..................................55

5.37 Documented operating procedures ..................................................................................................................................56

6 People controls ...................................................................................................................................................................................................57

6.1 Screening .................................................................................................................................................................................................. 57

6.2 Terms and conditions of employment .............................................................................................................................58

iii
© ISO/IEC 2021 – All rights reserved
---------------------- Page: 3 ----------------------
ISO/IEC FDIS 27002:2021(E)

6.3 Information security awareness, education and training ............................................................................ 59

6.4 Disciplinary process ....................................................................................................................................................................... 61

6.5 Responsibilities after termination or change of employment................................................................... 62

6.6 Confidentiality or non-disclosure agreements ....................................................................................................... 62

6.7 Remote working .................................................................................................................................................................................64

6.8 Information security event reporting.............................................................................................................................65

7 Physical controls ...............................................................................................................................................................................................66

7.1 Physical security perimeters ..................................................................................................................................................66

7.2 Physical entry ....................................................................................................................................................................................... 67

7.3 Securing offices, rooms and facilities ............................................................................................................................. 69

7.4 Physical security monitoring ........................................................................................................................................... .......69

7.5 Protecting against physical and environmental threats ............................................................................... 70

7.6 Working in secure areas ............................................................................................................................................................. 71

7.7 Clear desk and clear screen ......................................................................................................................................................72

7.8 Equipment siting and protection ........................................................................................................................................73

7.9 Security of assets off-premises ..............................................................................................................................................74

7.10 Storage media ....................................................................................................................................................................................... 75

7.11 Supporting utilities .......................................................................................................................................................................... 76

7.12 Cabling security ..................................................................................................................................................................................77

7.13 Equipment maintenance .............................................................................................................................................................78

7.14 Secure disposal or re-use of equipment ........................................................................................................................ 79

8 Technological controls ...............................................................................................................................................................................80

8.1 User endpoint devices ...................................................................................................................................................................80

8.2 Privileged access rights ...............................................................................................................................................................82

8.3 Information access restriction ..............................................................................................................................................83

8.4 Access to source code ....................................................................................................................................................................85

8.5 Secure authentication ...................................................................................................................................................................86

8.6 Capacity management ...................................................................................................................................................................88

8.7 Protection against malware ....................................................................................................................................................89

8.8 Management of technical vulnerabilities .....................................................................................................................90

8.9 Configuration management ..................................................................................................................................................... 93

8.10 Information deletion ...................................................................................................................................................................... 95

8.11 Data masking ........................................................................................................................................................................................97

8.12 Data leakage prevention .............................................................................................................................................................98

8.13 Information backup......................................................................................................................................................................100

8.14 Redundancy of information processing facilities .............................................................................................. 101

8.15 Logging ....................................................................................................................................................................................................102

8.16 Monitoring activities ...................................................................................................................................................................105

8.17 Clock synchronization ...............................................................................................................................................................106

8.18 Use of privileged utility programs ..................................................................................................................................107

8.19 Installation of software on operational systems ...............................................................................................108

8.20 Networks security .........................................................................................................................................................................109

8.21 Security of network services ............................................................................................................................................... 110

8.22 Segregation of networks ..........................................................................................................................................................112

8.23 Web filtering .......................................................................................................................................................................................113

8.24 Use of cryptography ....................................................................................................................................................................113

8.25 Secure development life cycle .............................................................................................................................................115

8.26 Application security requirements ................................................................................................................................ 116

8.27 Secure system architecture and engineering principles ............................................................................118

8.28 Secure coding.....................................................................................................................................................................................120

8.29 Security testing in development and acceptance ..............................................................................................123

8.30 Outsourced development ........................................................................................................................................................124

8.31 Separation of development, test and production environments..........................................................125

8.32 Change management ...................................................................................................................................................................126

8.33 Test information ..............................................................................................................................................................................128

8.34 Protection of information systems during audit testing ............................................................................128

Annex A (informative) Using attributes .................................................................................................................................................... 130

© ISO/IEC 2021 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/IEC FDIS 27002:2021(E)

Annex B (informative) Correspondence with ISO/IEC 27002:2013 ..............................................................................142

Bibliography ......................................................................................................................................................................................................................... 149

© ISO/IEC 2021 – All rights reserved
---------------------- Page: 5 ----------------------
ISO/IEC FDIS 27002:2021(E)
Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical

Commission) form the specialized system for worldwide standardization. National bodies that are

members of ISO or IEC participate in the development of International Standards through technical

committees established by the respective organization to deal with particular fields of technical

activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international

organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the

work.

The procedures used to develop this document and those intended for its further maintenance

are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria

needed for the different types of document should be noted. This document was drafted in

accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or

www.iec.ch/members_experts/refdocs).

Attention is drawn to the possibility that some of the elements of this document may be the subject

of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent

rights. Details of any patent rights identified during the development of the document will be in the

Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents) or the IEC

list of patent declarations received (see patents.iec.ch).

Any trade name used in this document is information given for the convenience of users and does not

constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO’s adherence to

the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see

www.iso.org/iso/foreword.html. In the IEC, see www.iec.ch/understanding-standards.

’This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,

Subcommittee SC 27, Information security, cybersecurity and privacy protection.

This third edition cancels and replaces the second edition (ISO/IEC 27002:2013), which has been

technically revised. It also incorporates the Technical Corrigenda ISO/IEC 27002:2013/Cor. 1:2014 and

ISO/IEC 27002:2013/Cor. 2:2015.
The main changes are as follows:
— the title has been modified;

— the structure of the document has been changed, presenting the controls using a simple taxonomy

and associated attributes;

— some controls have been merged, some deleted and several new controls have been introduced. The

complete correspondence can be found in Annex B.

Any feedback or questions on this document should be directed to the user’s national standards

body. A complete listing of these bodies can be found at www.iso.org/members.html and

www.iec.ch/national-committees.
© ISO/IEC 2021 – All rights reserved
---------------------- Page: 6 ----------------------
ISO/IEC FDIS 27002:2021(E)
Introduction
0.1 Background and context

This document is designed for organizations of all types and sizes. It is to be used as a reference for

determining and implementing controls for information security risk treatment in an information

security management system (ISMS) based on ISO/IEC 27001. It can also be used as a guidance

document for organizations determining and implementing commonly accepted information security

controls. Furthermore, this document is intended for use in developing industry and organization-

specific information security management guidelines, taking into consideration their specific

information security risk environment(s). Organizational or environment-specific controls other than

those included in this document can be determined through risk assessment as necessary.

Organizations of all types and sizes (including public and private sector, commercial and non-profit)

create, collect, process, store, transmit and dispose of information in many forms, including electronic,

physical and verbal (e.g. conversations and presentations).

The value of information goes beyond written words, numbers and images: knowledge, concepts, ideas

and brands are examples of intangible forms of information. In an interconnected world, information

and other associated assets deserve or require protection against various risk sources, whether natural,

accidental or deliberate.

Information security is achieved by implementing a suitable set of controls, including policies, rules,

processes, procedures, organizational structures and software and hardware functions. To meet its

specific security and business objectives, the organization should define, implement, monitor, review

and improve these controls where necessary. An ISMS such as that specified in ISO/IEC 27001 takes a

holistic, coordinated view of the organization’s information security risks in order to determine and

implement a comprehensive suite of information security controls within the overall framework of a

coherent management system.

Many information systems, including their management and operations, have not been designed to be

secure in terms of an ISMS as specified in ISO/IEC 27001 and this document. The level of security that

can be achieved only through technological measures is limited and should be supported by appropriate

management activities and organizational processes. Identifying which controls should be in place

requires careful planning and attention to detail while carrying out risk treatment.

A successful ISMS requires support from all personnel in the organization. It can also require

participation from other interested parties, such as shareholders or suppliers. Advice from subject

matter experts can also be needed.

A suitable, adequate and effective information security management system provides assurance to the

organization’s management and other interested parties that their information and other associated

assets are kept reasonably secure and protected against threats and harm, thereby enabling the

organization to achieve the stated business objectives.
0.2 Information security requirements

It is essential that an organization determines its information security requirements. There are three

main sources of information security requirements:

a) the assessment of risks to the organization, taking into account the organization’s overall business

strategy and objectives. This can be facilitated or supported through an information security-

specific risk assessment. This should result in the determination of the controls necessary to

ensure that the residual risk to the organization meets its risk acceptance criteria;

b) the legal, statutory, regulatory and contractual requirements that an organization and its

interested parties (trading partners, service providers, etc.) have to comply with and their socio-

cultural environment;
vii
© ISO/IEC 2021 – All rights reserved
---------------------- Page: 7 ----------------------
ISO/IEC FDIS 27002:2021(E)

c) the set of principles, objectives and business requirements for all the steps of the life cycle of

information that an organization has developed to support its operations.
0.3 Controls

A control is defined as a measure that modifies or maintains risk. Some of the controls in this document

are controls that modify risk, while others maintain risk. An information security policy, for example,

can only maintain risk, whereas compliance with the information security policy can modif

...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.