Skip to main content
ControlFrameby LockedIn Labs
Framework library

Requirements & evidence

ISO/IEC 27002

The controls catalog underlying ISO/IEC 27001 Annex A — a genuinely separate, currently published standard, not a duplicate of 27001. Buyers who ask for '27001 evidence' routinely cite 27002 control numbers.

Edition on record
2022
Edition published
Source last checked

Understand the scope

What the framework covers.

The library records this framework for all sectors, SaaS, technology, across global. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.

Areas of requirement

  • Organizational
  • People
  • Physical
  • Technological

The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.

Source access and licensing

Licensed standard — purchase from ISO or a national member body and obtain software-use rights before verbatim ingestion.

Prepare with context

The evidence behind
the requirements.

Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.

A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.

ControlFrame availability

Framework reference available

Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.

How availability is determined

ISO/IEC 27002 is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.

Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.

Acquisition required before authoritative verbatim inventory generation.

Follow the source

Editions and transitions.

These are the editions recorded in the library, checked September 6, 2026. Confirm the applicable edition with the authority before beginning an assessment.

  • 2022Current edition on record · Replaces 2013
  • 2013Superseded edition
    Publication date not recorded
Recorded change history

· ISO/IEC 27002 2022 supersedes 2013 and is the current edition.

Check the basis

Sources you can follow.

Corroborated through independent sources; direct verification with the authority was unavailable. Source verification was recorded on September 6, 2026.

Catalog provenance and record details

Framework record: iso-27002-2022.

Source artifact: acquisition required.

Parsed catalog: Not ingested.

Control families as published: Organizational · People · Physical · Technological.

Record last updated: September 6, 2026.

Common questions

A closer look.

What is ISO/IEC 27002?

The controls catalog underlying ISO/IEC 27001 Annex A — a genuinely separate, currently published standard, not a duplicate of 27001. Buyers who ask for '27001 evidence' routinely cite 27002 control numbers.

Who does ISO/IEC 27002 apply to?

ISO/IEC 27002 applies to all sectors, SaaS, technology, global, per ISO/IEC 27002:2022.

What is the current version of ISO/IEC 27002?

The current edition is 2022, issued by ISO/IEC 27002:2022 and published 2022-02-15. Source: https://www.iso.org/standard/75652.html.

What does an assessment under ISO/IEC 27002 require?

No control catalog has been ingested for ISO/IEC 27002 yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.

At a glance

ISO/IEC 27002

2022

Framework reference
Authority and edition tracked
Evidence preparation
Framework reference available
Source confidence
Independent corroboration

A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.

Continue exploring

Related frameworks.

ISO/IEC 27017

Also applies to SaaS · Cloud-specific information security guidance for both cloud customers and providers, extending ISO/IEC 27002 with shared-responsibility and cloud-control guidance. It is guidance, not a standalone certification or a claim about ControlFrame's cloud environment.

ISO/IEC 27018

Also applies to SaaS · Privacy guidance for public-cloud providers acting as processors of personally identifiable information. It complements ISO/IEC 27001 and 27002; it is not a regulation, standalone certification, or claim that ControlFrame is certified.

ISO/IEC 27001

Also applies to all sectors · The international certifiable standard for an information security management system. Amendment 1:2024 added climate-change considerations to clauses 4.1 and 4.2. The 2013-edition certificate-transition deadline was 2025-10-31; no legitimate 2013-certified organization remains.

ISO/IEC 23894

Also applies to technology · International guidance for integrating AI-specific risk management into organizations that develop, provide, deploy, or use AI systems. It complements ISO/IEC 42001 and is guidance, not a standalone certification.

Make the requirements
part of the work.

Explore how ControlFrame can organize ISO/IEC 27002 requirements, evidence preparation, and review for your assessment scope.

Request a walkthrough
ISO/IEC 27002 | ControlFrame