What is ISO/IEC 27002?
ISO/IEC 27002 is the companion to ISO/IEC 27001. Where ISO/IEC 27001 says an organisation must run an information security management system and consider a list of controls in its Annex A, ISO/IEC 27002 explains each of those controls: its purpose and how it is typically put in place. The current third edition was published in February 2022, with a corrected version in March 2022, and replaced the 2013 edition.
How is it organised?
The 2022 edition groups its 93 controls into four themes:
- organisational controls (37), such as policies, roles, supplier relationships and incident management;
- people controls (8), such as screening, awareness and remote working;
- physical controls (14), such as secure areas and equipment;
- technological controls (34), such as access, cryptography, logging and secure development.
Each control also carries attributes, such as whether it is preventive, detective or corrective, and which security properties it serves. Attributes let an organisation sort and filter the controls in its own ways, for example to line them up with another framework.
Who uses it?
Anyone building or running an ISO/IEC 27001 system uses it to decide how to implement the Annex A controls they select. It is also useful on its own as a well-established catalogue of good practice, even for organisations with no plans to certify.
Can you certify to it?
No. ISO/IEC 27002 is guidance. Certification is always against ISO/IEC 27001, whose Annex A lists the same 93 controls in short form. An auditor will look at how you apply the controls, and ISO/IEC 27002 is the reference most auditors expect you to have used.
How does it relate to other frameworks?
Several sector standards build directly on it, adding guidance for their own setting: ISO/IEC 27017 for cloud services, ISO/IEC 27018 for personal data in public clouds and ISO/IEC 27701 for privacy. Mappings from ISO/IEC 27002 to NIST frameworks and others are widely available, though they are not part of the standard.
Sources and official references
- ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection — Information security controls — ISO (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud by your own device, in the most natural English voice it has. Nothing is sent anywhere. Pick another voice or speed if you prefer.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with ISO and IEC (ISO/IEC JTC 1/SC 27).