ISO/IEC 27002:2022

Code of practice for info-sec controls - 4 themes (Org/People/Physical/Tech), 93 controls.


Short name	ISO 27002
Region	International
Country or scope	International
Sector	General
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers ISO 27002

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 23 controls from Safeguard's control catalog for ISO 27002.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 4 written for ISO 27002 and 19 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`ISO27002-5.9` Inventory of Information and Associated Assets	An inventory of information and other associated assets, including software, must be developed and maintained with identified owners, which for applications means a non-empty component inventory (ISO/IEC 27002:2022 control 5.9)	Scan
`ISO27002-5.19` Information Security in Supplier Relationships	Processes must manage the information security risks associated with the use of supplier products and services, which requires knowing the supplier of each software component in use (ISO/IEC 27002:2022 control 5.19)	Scan
`ISO27002-5.21` Managing Security in the ICT Supply Chain	Risks associated with the ICT products and services supply chain must be managed, including visibility into how acquired components depend on further upstream components (ISO/IEC 27002:2022 control 5.21)	Scan
`ISO27002-8.8` Management of Technical Vulnerabilities	Information about technical vulnerabilities of systems in use must be obtained and exposure evaluated, which requires version-level knowledge of every deployed component to match against advisories (ISO/IEC 27002:2022 control 8.8)	Scan
`ISO27002-8.9` Configuration Management	Configurations, including of software, must be established, documented and monitored, which excludes vague or floating version specifications that make the deployed configuration ambiguous (ISO/IEC 27002:2022 control 8.9)	Scan
`ISO27002-8.24` Use of Cryptography for Integrity	Rules for the effective use of cryptography, including for protecting the authenticity and integrity of information, support verifying software artifacts via cryptographic hashes (ISO/IEC 27002:2022 control 8.24)	Scan
`ISO27002-5.37` Documented Operating Procedures	Operating procedures for information processing facilities must be documented and available, supported by identifiable, timestamped machine-readable records of what software those facilities run (ISO/IEC 27002:2022 control 5.37)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`A.5.1`	Policies for Information Security
`A.5.7`	Threat Intelligence
`A.5.9`	Inventory of Information and Other Associated Assets
`A.5.10`	Acceptable Use of Information and Other Associated Assets
`A.5.15`	Access Control
`A.5.19`	Information Security in Supplier Relationships
`A.5.23`	Information Security for Use of Cloud Services
`A.5.30`	ICT Readiness for Business Continuity
`A.5.34`	Privacy and Protection of Personal Identifiable Information (PII)
`A.6.1`	Screening
`A.6.3`	Information Security Awareness, Education and Training
`A.7.4`	Physical Security Monitoring
`A.7.10`	Storage Media
`A.8.1`	User Endpoint Devices
`A.8.2`	Privileged Access Rights
`A.8.5`	Secure Authentication
`A.8.7`	Protection Against Malware
`A.8.8`	Management of Technical Vulnerabilities
`A.8.9`	Configuration Management
`A.8.16`	Monitoring Activities
`A.8.23`	Web Filtering
`A.8.28`	Secure Coding
`A.8.32`	Change Management

Policy templates

Written for ISO 27002:

Information Security Policy
Acceptable Use Policy
Supplier and Third-Party Security Policy
Secure Software Development Policy

And 19 from the standard set, adapted to ISO 27002.