ISO/IEC 27002:2022 Copilot
Navigate the implementation guidance behind ISO 27001's 93 controls
What the ISO/IEC 27002:2022 Copilot Can Do
Understand the purpose and scope of all 93 controls across four themes
Identify which of the 11 controls new in 2022 apply to your context
Map controls to your ISO 27001 Annex A entries using correct identifiers
Interpret guidance for cloud-specific controls such as 5.23 and 8.12
Compare the 2022 structure with the superseded 2013 clause layout
Draft implementation notes aligned to a given control's stated objectives
About ISO/IEC 27002:2022 Copilot
ISO/IEC 27002:2022 is the code of practice that provides purpose, guidance, and context for each control in ISO 27001:2022 Annex A. The Copilot helps you work through all four themes — Organizational, People, Physical, and Technological — so you can turn terse control titles into actionable implementation decisions.
Who it's for
ISO 27001
ISO 27002 is the implementation guide for the Annex A controls referenced by ISO 27001 — ISMS teams often use both together.
ISO 27017
Extends ISO 27002 with cloud-specific implementation guidance for both customers and providers.
ISO 27018
Extends ISO 27002 with controls for PII processed in public cloud services.
Frequently Asked Questions
What is ISO/IEC 27002:2022?
ISO/IEC 27002:2022 is a code of practice that provides implementation guidance for the 93 information security controls listed in ISO 27001:2022 Annex A. It restructured the 2013 edition from 14 clauses and 114 controls into four themes — Organizational (37), People (8), Physical (14), and Technological (34) — and introduced 11 new controls.
How does the ISO/IEC 27002:2022 Copilot help?
The Copilot helps you understand, interpret, and apply the guidance behind specific controls — for example, navigating the new threat intelligence control (5.7) or data masking control (8.11) — supporting the implementation work that sits between an ISO 27001 audit requirement and day-to-day practice.
Can ISO/IEC 27002:2022 be used for certification on its own?
No — certification is issued against ISO/IEC 27001, which is the auditable management-system standard; ISO 27002 is a code of practice that provides implementation guidance for Annex A's control titles and is not independently auditable.
Ready to streamline your compliance work?
Built for speed, accuracy, and audit-ready output.