ISO 27002:2022 Controls — Implementation Guidance and Gap Assessment
ISO 27002 is the guidance behind ISO 27001 Annex A. It explains the purpose of each of the 93 controls and how to implement them, grouped into four themes: organisational, people, physical and technological.
Mutex Systems uses ISO 27002 to design controls that fit how you work — and to prepare evidence auditors accept.
- Category
- Compliance Framework
- Jurisdiction
- International
- Issuing Body
- ISO / IEC
- Current Version
- ISO/IEC 27002:2022
- Who It's For
- Organisations implementing or maintaining ISO 27001, and any organisation wanting a recognised control baseline.
Core Domains
A Practical Compliance Path
- 01
Gap assessment
Assess each control against current practice.
- 02
Statement of Applicability
Decide which controls apply and why.
- 03
Implement
Policies, procedures and technical controls per the guidance.
- 04
Evidence
Collect evidence auditors expect for each control.
Controls that fit, evidence that passes
We implement the guidance in proportion to your size and risk, not as a paperwork exercise.
- Control-by-control gap assessment
- SoA and policy set
- Technical implementation support
All 93 controls, mapped and evidenced
grComply tracks the ISO 27002 controls with owners, evidence schedules and cross-mapping to SOC 2, NIST CSF, PCI DSS and local regulations.
- Control owners and evidence schedules set from your own policy
- One piece of evidence counted against many frameworks
- Scan findings mapped to technological controls
- Live completion per theme
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About ISO 27002
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 is the certifiable management-system standard and lists the controls in Annex A. ISO 27002 is guidance on implementing those controls; you cannot certify against it.
How many controls are in ISO 27002:2022?
93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological, including 11 new controls.
Ready to Start Your ISO 27002 Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.