Framework overlap

Does ISO 27001:2022 cover ISO 27002:2022?

You hold ISO 27001:2022 and have been told to do ISO 27002:2022. Here is how much overlaps, control by control.

35% of ISO 27002:2022 you already have

ISO 27001:2022 already covers about 35% of ISO 27002:2022, leaving 56 of 86 controls as genuinely new work.

Already covered 19 Likely covered 11 New work 56

What is genuinely new work

Nothing in ISO 27001:2022 reaches these. This is the list to scope.

4.1
Clauses
4.2
Themes and attributes
4.3
Control layout
5.10
Acceptable use of information and other associated assets
5.20
Addressing information security within supplier agreements
5.21
Managing information security in the ICT supply chain
5.22
Monitoring, review and change management of supplier services
5.24
Information security incident management planning and preparation
5.25
Assessment and decision on information security events
5.26
Response to information security incidents
5.27
Learning from information security incidents
5.30
ICT readiness for business continuity
5.31
Legal, statutory, regulatory and contractual requirements
5.34
Privacy and protection of PII
5.36
Compliance with policies, rules and standards for information security
5.37
Documented operating procedures
5.6
Contact with special interest groups
6.3
Information security awareness, education and training
6.5
Responsibilities after termination or change of employment
7.10
Storage media
7.11
Supporting utilities
7.12
Cabling security
7.13
Equipment maintenance
7.14
Secure disposal or re-use of equipment
7.3
Securing offices, rooms and facilities
7.5
Protecting against physical and environmental threats
7.6
Working in secure areas
7.7
Clear desk and clear screen
7.8
Equipment siting and protection
7.9
Security of assets off-premises
8.1
User endpoint devices
8.10
Information deletion
8.11
Data masking
8.12
Data leakage prevention
8.13
Information backup
8.14
Redundancy of information processing facilities
8.15
Logging
8.17
Clock synchronization
8.19
Installation of software on operational systems
8.20
Networks security
8.21
Security of network services
8.22
Segregation of networks
8.23
Web filtering
8.24
Use of cryptography
8.25
Secure development life cycle
8.26
Application security requirements
8.27
Secure system architecture and engineering principles
8.28
Secure coding
8.29
Security testing in development and acceptance
8.30
Outsourced development
8.31
Separation of development, test and production environments
8.32
Change management
8.33
Test information
8.34
Protection of information systems during audit testing
8.6
Capacity management
8.9
Configuration management
Show the 30 you already have
5.11
Return of assets
5.12
Classification of information
5.13
Labelling of information
5.14
Information transfer
5.16
Identity management
5.17
Authentication information
5.18
Access rights
5.28
Collection of evidence
5.3
Segregation of duties
5.32
Intellectual property rights
5.33
Protection of records
5.4
Management responsibilities
5.5
Contact with authorities
6.1
Screening
6.4
Disciplinary process
6.7
Remote working
7.1
Physical security perimeters
7.2
Physical entry
7.4
Physical security monitoring
5.1
Policies for information security
5.19
Information security in supplier relationships
5.2
Information security roles and responsibilities
5.23
Information security for use of cloud services
5.29
Information security during disruption
5.35
Independent review of information security
6.2
Terms and conditions of employment
6.6
Confidentiality or non-disclosure agreements
6.8
Information security event reporting
8.16
Monitoring activities
8.18
Use of privileged utility programs

How this is calculated

Already covered means a mapping runs from a control in ISO 27001:2022 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition