Put ISO 27002 controls into practice, with evidence to show for it

ISO 27002:2022 is the international guidance standard for information security controls, published by ISO and IEC in February 2022. It describes 93 controls in four themes, organisational, people, physical and technological, and for each one gives a control statement, its purpose and practical implementation guidance. It replaced the 2013 edition, which had 114 controls in 14 domains.

ISO 27001 sets the requirements for an information security management system and is the standard organisations certify against. ISO 27002 is guidance only: it explains how to implement the security controls listed in ISO 27001 Annex A. In the 2022 editions the 93 controls match, so Annex A tells you which controls exist and ISO 27002 tells you how to apply them.

No. ISO 27002 is a code of practice, not a requirements standard, so accredited certification bodies do not certify against it. Organisations that want a certificate certify their information security management system against ISO 27001 and use ISO 27002 as guidance when implementing and justifying the Annex A controls they select in their Statement of Applicability.

ISO 27002:2022 contains 93 controls, down from 114 in the 2013 edition. They are grouped into four themes: 37 organisational controls in clause 5, 8 people controls in clause 6, 14 physical controls in clause 7 and 34 technological controls in clause 8. The edition introduced 11 new controls, including threat intelligence, information security for use of cloud services, data masking, data leakage prevention and secure coding.

Attributes are tags the 2022 edition attaches to every control so organisations can filter and view controls in different ways. There are five attribute types: control type, information security properties, cybersecurity concepts, operational capabilities and security domains. For example, you can list every preventive control, or every control supporting the cybersecurity concept of detect, without changing the four-theme structure.

No law requires ISO 27002, so following it is voluntary. In practice it is used by any organisation implementing ISO 27001, because certification auditors expect Annex A controls to be applied sensibly and ISO 27002 is the recognised guide. Organisations without certification plans also use it as a practical security baseline and to answer customer due diligence.

Yes, partly. ISO 27002 controls such as privacy and protection of PII, access control, logging and incident management support the security of processing that UK GDPR and EU GDPR require, though they do not cover every data protection obligation. Many ISO 27002 controls also overlap with SOC 2 criteria, so a well-mapped control set lets the same evidence support several frameworks.

ISO 27002:2022 is mapped in OneClickComply's control library and is available on request. Its controls sit alongside ISO 27001, which OneClickComply supports, so evidence from automated collection, continuous monitoring and AutoComplete policies can be tracked against both. Contact us to have ISO 27002 enabled in your workspace and to talk through your requirements with our team.