ISO 27002: Guide to Information Security Controls
ISO/IEC 27002 is the companion standard to ISO 27001, providing detailed implementation guidance for each of the 93 controls listed in Annex A. While ISO 27001 defines what an ISMS must achieve, ISO 27002 explains how to implement each control effectively.
What ISO 27002 Covers
The 2022 revision restructured controls from 14 domains into four themes: organizational, people, physical, and technological. Each control includes implementation guidance, explanatory notes, and attributes such as control type, cybersecurity concept, and operational capability. This attribute-based taxonomy makes it far easier to map controls to other frameworks and filter by relevance.
New controls added in the 2022 edition address modern threats including threat intelligence, cloud service security, ICT readiness for business continuity, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding.
Who Needs ISO 27002
ISO 27002 is essential for anyone implementing ISO 27001. Security teams use it as a practical reference when designing controls, writing policies, and building procedures. Risk managers reference it when evaluating whether selected controls adequately address identified risks.
Organizations not pursuing ISO 27001 certification still benefit from ISO 27002 as a comprehensive control catalogue. It serves as a best-practice reference for building security programs regardless of whether formal certification is the goal.
How to Use ISO 27002
- Start with your risk assessment — Identify threats and vulnerabilities relevant to your organization
- Select applicable controls — Use the Statement of Applicability to determine which of the 93 controls apply
- Review implementation guidance — ISO 27002 provides detailed how-to for each control
- Adapt to your context — Tailor implementation guidance to your size, industry, and risk appetite
- Document decisions — Record why controls were selected or excluded
Relationship to ISO 27001
ISO 27002 does not carry its own certification. Organizations certify against ISO 27001, using ISO 27002 as the implementation guide. Auditors frequently reference ISO 27002 when evaluating whether controls meet the intent of Annex A requirements.