What is ISO 27002?
ISO 27002 is the international guidance that explains, for each security control, what its purpose is and how to implement it. The current version, ISO/IEC 27002:2022, describes 93 controls in four themes: organisational, people, physical and technological. You cannot get certified against ISO 27002. You use it as a reference when you implement the controls from ISO 27001.
The full title is “Information security, cybersecurity and privacy protection: Information security controls”. You can buy the standard from ISO , and in the Netherlands as NEN-EN-ISO/IEC 27002:2022 from NEN . For the difference with the certifiable standard, read ISO 27001 vs. ISO 27002. This page is about ISO 27002 itself.
In short: Annex A of ISO 27001 gives one sentence per control. ISO 27002 gives about one page of explanation per control. The same 93 controls, the same numbers, much more detail.
ISO 27002 at a glance
| Full name | ISO/IEC 27002:2022, Information security controls |
| Type of document | Guidance with implementation explanations, not a requirements standard |
| Can you get certified? | No |
| Number of controls | 93, of which 11 are new compared with 2013 |
| Structure | Four themes: clauses 5 to 8 |
| Added in 2022 | Five types of attributes per control |
| Used by | ISO 27001, the BIO2 (Dutch government information security baseline), NEN 7510 (Dutch healthcare information security standard) and sector guidelines |
How is ISO 27002 structured?
ISO 27002:2022 has eight clauses and two annexes. Clauses 1 to 4 are introductory: scope, definitions and an explanation of the structure. The controls follow after that.
| Clause | Theme | Number of controls | Examples |
|---|---|---|---|
| 5 | Organisational controls | 37 | Policies, roles, suppliers, incidents |
| 6 | People controls | 8 | Screening, awareness, remote working |
| 7 | Physical controls | 14 | Access to buildings, clean desk, equipment |
| 8 | Technological controls | 34 | Authentication, back-up, logging, secure coding |
Annex A explains how to use the attributes. Annex B is a comparison table between the 2022 version and the 2013 version. This is handy if you still have old documents with numbers such as A.9.4.3.
What does a control look like in ISO 27002?
Every control has the same fixed structure. Take control 8.13 on information backup as an example.
| Part | What it contains | Example for 8.13 Information backup |
|---|---|---|
| Attributes | A table with labels in five categories | Corrective, integrity and availability, restore |
| Control | The short sentence, the same as Annex A of ISO 27001 | Backups of information, software and systems are kept and tested regularly |
| Purpose | Why the control exists | Making recovery possible after loss of data or systems |
| Guidance | The actual explanation, often a page or more | What you record in a backup policy, how often you test, where you keep copies |
| Other information | Background and references to other standards | Reference to continuity standards |
The summaries in this table are our own words. You can find a completed backup policy based on this control at backup policy under ISO 27001.
What are the attributes in ISO 27002?
Since 2022, every control has labels in five categories. You can use them to filter and sort the 93 controls, for example for a report to the board or to see which controls help with detection.
| Attribute | Possible values | What you use it for |
|---|---|---|
| Control type | Preventive, detective, corrective | Checking the balance between preventing and noticing |
| Information security property | Confidentiality, integrity, availability | Linking to your risk analysis |
| Cybersecurity concept | Identify, protect, detect, respond, recover | Aligning with the NIST Cybersecurity Framework |
| Operational capability | Among others governance, asset management, access management, continuity, suppliers | Grouping controls by team or owner |
| Security domain | Governance and ecosystem, protection, defence, resilience | An overview for the board and management |
An example: control 8.5 on secure authentication is preventive, affects confidentiality, integrity and availability, falls under “protect” and belongs to the access management capability. If you filter your Statement of Applicability (SoA) on “detective”, you immediately see whether you have enough controls that spot an attack.
Which controls are new in ISO 27002:2022?
Eleven controls did not exist in 2013. They show where threats have changed in recent years.
| No. | Control | What it is about |
|---|---|---|
| 5.7 | Threat intelligence | Collecting and using information about threats |
| 5.23 | Information security for cloud services | Requirements for buying, using and ending cloud services |
| 5.30 | ICT readiness for business continuity | Preparing IT for disruptions |
| 7.4 | Physical security monitoring | Cameras and alarms at buildings |
| 8.9 | Configuration management | Fixed, secure settings for systems |
| 8.10 | Information deletion | Deleting data when you no longer need it |
| 8.11 | Data masking | Shielding personal data, for example in test environments |
| 8.12 | Data leakage prevention | Technical measures against data leaking out |
| 8.16 | Monitoring activities | Spotting unusual behaviour in networks and systems |
| 8.23 | Web filtering | Restricting access to harmful websites |
| 8.28 | Secure coding | Secure principles in software development |
How do you use ISO 27002 in practice?
You do not need to read ISO 27002 from start to finish. Use it at three moments.
- During the risk analysis. For each risk, find which controls reduce it, and read in ISO 27002 what they involve.
- When writing policies. The guidance per control is a good checklist for what a policy or procedure should contain.
- When preparing for the audit. If you are unsure whether a control is set up well enough, ISO 27002 gives you direction.
Extensions build on the same structure. ISO 27017 adds cloud controls, and ISO 27018 adds controls for personal data in the public cloud. The Dutch government also uses ISO 27002 as a basis. See BIO2 and ISO 27001.
What will the auditor look for if you use ISO 27002?
The certification body assesses you against ISO 27001, not against ISO 27002. You will still see its influence. The auditor wants you to explain why a control is set up the way it is in your organisation. “We follow the ISO 27002 guidance, with this adjustment because…” is a strong answer.
Common mistakes with ISO 27002
- Copying all the guidance word for word. The guidance is advice. Choose what fits your risks.
- Using an old version. If you still work with the 2013 numbering, use annex B to switch over.
- Buying ISO 27002 without ISO 27001. If you want to get certified, you need ISO 27001 first.
- Ignoring the attributes. They take little effort and make your reports much clearer.
Frequently asked questions about ISO 27002
Can you get certified for ISO 27002?
No. ISO 27002 contains no requirements, only explanations and advice. A certification body assesses against ISO 27001. Anyone who says they are “ISO 27002 certified” usually means they have ISO 27001 and set up the controls according to ISO 27002.
Is ISO 27002 available for free?
No. The text of the standard is protected by copyright, and you buy it from ISO or NEN. For government organisations, the Dutch Ministry of the Interior and Kingdom Relations (BZK) made ISO 27001 and ISO 27002 available free of charge through NEN, as described on BIO2 and ISO 27001.
Do I need ISO 27002 if I already have ISO 27001?
It is not required, but it is useful. Annex A of ISO 27001 gives only the title and one sentence per control. If you want to know what an auditor considers reasonable, ISO 27002 is the place to look.
More information
- ISO 27001 vs. ISO 27002: the difference between requirements and guidance
- Annex A of ISO 27001: the 93 controls per theme
- Statement of Applicability: where you record your choices
- Changes and transition: what changed in 2022