ISO/IEC 27002
ISO/IEC 27002 is the international guidance standard that describes each of the 93 information security controls referenced by Annex A of ISO/IEC 27001 — what the control is, what it is for, and how to implement it.
What it covers
ISO/IEC 27002:2022 groups the controls into four themes: 37 organizational controls (policies, roles, asset management, supplier security, incident management), 8 people controls (screening, awareness training, employment terms), 14 physical controls (access control, equipment protection, secure disposal), and 34 technological controls (access control, cryptography, network security, logging, vulnerability management, backups).
Each control entry includes the control statement, its purpose, implementation guidance, and attributes that tag it by control type (preventive, detective, corrective), security property (confidentiality, integrity, availability), and cybersecurity concept — which makes the list usable as a design checklist, not just an audit checklist.
How it relates to ISO 27001
ISO 27001 is the certifiable requirements standard; ISO 27002 is the guidance you use to implement it. When a clause-6.1.2 risk assessment shows a control is needed, ISO 27002 tells you what good implementation looks like — and your Statement of Applicability records the decision. You cannot certify against ISO 27002 itself.
Related Standards
- •ISO/IEC 27002:2022 — Information security, cybersecurity and privacy protection — Information security controls
- •ISO/IEC 27001:2022 — ISMS requirements
Free Tools & Resources
Further Reading
Need help with this?
We consult and build across all of these domains — tell us what you are working on.