ISO 27002:2022 groups 93 controls into four themes: organizational, people, physical and technological. It also tags each control with attributes, five types in all, so you can filter the same list by control type, security property, cybersecurity concept, operational capability or security domain.
From 14 domains to four themes
The 2013 edition had 114 controls in 14 clauses. The 2022 edition has 93, in four themes:
- Organizational controls
- People controls
- Physical controls
- Technological controls
The change came from 11 new controls, 24 merges of two or more older controls, and 58 controls that were reviewed and revised. The result is 21 fewer controls overall, although several topics are new.
Purpose statements
Each control now has a purpose element. In 2013 an objective sat over a group of controls. A per control purpose makes it easier to write the "why" column in a Statement of Applicability and to explain a control to a non specialist.
The five attribute types
Attributes let you view the same controls through different lenses. One reference lists them as:
- Control type
- Information security properties
- Cybersecurity concepts
- Operational capabilities
- Security domains
Annex A of the standard gives guidance on applying attributes. I could not confirm the full list of values for each type from the sources used here, so read the standard for the exact terms.
Using attributes in practice
Attributes help in three ways:
- Risk assessment: filter controls by the property you want to protect, for example confidentiality.
- Ownership: group controls by capability so each owner sees only theirs.
- Reporting: show a customer or a board how coverage looks by lens rather than by a 93 line list.
A sheet with one row per control and a column per attribute makes this easy to do with plain filters.
What to do with an older ISMS
If your documents use 2013 numbering, use the mapping annex in ISO 27002 to translate. Then check for the new controls that had no equivalent. Our post on the eleven new controls goes through them.
The mapping to other frameworks is a similar exercise at a larger scale.
Click through it at your own pace, or open it full screen.
A simple way to start
Build one sheet with the 93 controls down the side. Add columns for owner, status, evidence link and the attributes you care about. Sort by theme to assign owners: the people theme tends to sit with HR and managers, the physical theme with facilities or a landlord, and the technological theme with engineering. That one sheet doubles as the working copy of your Statement of Applicability.
Quick check
How many controls does ISO 27002:2022 have?
93, grouped into four themes. The 2013 edition had 114.
Do attributes change what an auditor checks?
They are a way to organise and filter controls. Certification is still decided against ISO 27001 and your Statement of Applicability.
Sources
Last reviewed: 19 October 2026.
