Understanding the ISO/IEC 27002:2022 standard
ISO 27002 is the code of practice that details the security controls in Annex A of ISO 27001. 4 themes, 93 controls, 5 attributes: here is how to navigate them and implement them effectively.
What is ISO/IEC 27002?
ISO/IEC 27002:2022 is the code of practice that explains how to implement the 93 controls in Annex A of ISO 27001 — it is not certifiable in its own right.
ISO/IEC 27002:2022 is a code of good practice: a guide that describes the information security controls in detail. Whereas ISO 27001 sets the requirements of the ISMS, ISO 27002 explains how: for each control, it specifies its objective, implementation recommendations and practical guidance. For the official presentation of the standard, see the PECB ISO/IEC 27002 page, a certification body and BCIT partner.
Published by theISO in February 2022, 8 months before ISO 27001:2022, the current edition describes 93 controls across 4 themes: 37 organizational, 8 people-related, 14 physical and 34 technological, meaning 37% are technical controls. The 2013 edition had 114 across 14 domains. 11 controls are new:
- 5.7 Threat intelligence
- 5.23 Information security for use of cloud services
- 5.30 ICT readiness for business continuity
- 7.4 Physical security monitoring
- 8.9 Configuration management
- 8.10 Information deletion
- 8.11 Data masking
- 8.12 Data leakage prevention
- 8.16 Monitoring activities
- 8.23 Web filtering
- 8.28 Secure coding
These controls address the requirement for a comprehensive approach set out by the directive NIS 2 states as follows: “The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and their physical environment from incidents” (Directive (EU) 2022/2555, Article 21, paragraph 2). For practical guidance in French, the 42 measures in the ANSSI guide to information security hygiene are a good starting point before covering all of Annex A.
Key point: ISO 27002 is not certifiable. It is a supporting standard. You do not get certified to “ISO 27002”; instead, you use it to implement correctly the controls selected as part of an ISMS compliant with ISO 27001.
What are the 4 control themes?
Organizational (37)
Policies, roles and responsibilities, asset management, supplier relationships, incident management and business continuity.
People-related (8)
Awareness, training, background checks, remote working, disciplinary processes and termination.
Physical (14)
Premises security, secure areas, equipment protection, storage media and maintenance.
Technological (34)
Access control, encryption, logging, malware protection, development security and network security.
| Theme | Number of controls |
|---|---|
| Organizational | 37 |
| People-related | 8 |
| Physical | 14 |
| Technological | 34 |
| Total | 93 |
How does it relate to Annex A of ISO 27001?
The 2022 revision fully aligned the two standards: the 93 controls in ISO 27002:2022 correspond one-to-one with the controls in Annex A of ISO 27001:2022. Annex A gives each control’s title and a brief description; ISO 27002 provides the complete instructions. In practice, you use ISO 27002 to justify, design and implement each control that your risk assessment led you to select for your Statement of Applicability (SoA).
Before 2022, the standard contained 114 controls in 14 categories; the 2022 revision consolidated them into 93 controls and 4 themes. The alignment described above has existed only since this edition.
What are the 5 attributes in the 2022 version?
A major new feature of the 2022 edition: each control now has 5 attributes that let you sort and filter it along different governance dimensions. These are: control type (preventive, detective, corrective), security properties (confidentiality, integrity, availability), cybersecurity concepts (identify, protect, detect, respond, recover), operational capabilities and security domains. They make it easier to map controls to other frameworks (NIST, etc.) and manage them.
How do you move from a control to implementation?
Start with risks
Identify the risks to address from the organization’s risk assessment in the ISMS.
Select controls
Choose from the 93 controls those that genuinely reduce your risks, and document the SoA.
Implement
Implement each control by following the detailed recommendations in ISO 27002.
Measure & improve
Evaluate control effectiveness and adjust controls as part of continual improvement.
Document (SoA)
Justify each included or excluded control in the Statement of Applicability, a central part of the audit.
Audit & review
Periodically review whether the controls remain appropriate as risks and context change.
Why work with BCIT?
Relevant selection
We help you choose the controls that matter to your risks, without unnecessary burden or blind spots.
Practical implementation
Operational implementation tailored to your tools, teams and actual maturity.
Robust SoA
A Statement of Applicability clear and defensible, ready for thecertification audit.
Need help selecting and implementing your controls?
BCIT Formation supports you in selecting and implementing ISO 27002 controls, in line with your ISMS — rated 4.7/5 on Trustpilot. Let’s discuss your situation.
Understanding the ISO/IEC 27002:2022 standard
ISO 27002 is the code of practice that details the security controls in Annex A of ISO 27001. 4 themes, 93 controls, 5 attributes: here is how to navigate them and implement them effectively.
What is ISO/IEC 27002?
ISO/IEC 27002:2022 is the code of practice that explains how to implement the 93 controls in Annex A of ISO 27001 — it is not certifiable in its own right.
ISO/IEC 27002:2022 is a code of good practice: a guide that describes the information security controls in detail. Whereas ISO 27001 sets the requirements of the ISMS, ISO 27002 explains how: for each control, it specifies its objective, implementation recommendations and practical guidance. For the official presentation of the standard, see the PECB ISO/IEC 27002 page, a certification body and BCIT partner.
Published by theISO in February 2022, 8 months before ISO 27001:2022, the current edition describes 93 controls across 4 themes: 37 organizational, 8 people-related, 14 physical and 34 technological, meaning 37% are technical controls. The 2013 edition had 114 across 14 domains. 11 controls are new:
- 5.7 Threat intelligence
- 5.23 Information security for use of cloud services
- 5.30 ICT readiness for business continuity
- 7.4 Physical security monitoring
- 8.9 Configuration management
- 8.10 Information deletion
- 8.11 Data masking
- 8.12 Data leakage prevention
- 8.16 Monitoring activities
- 8.23 Web filtering
- 8.28 Secure coding
These controls address the requirement for a comprehensive approach set out by the directive NIS 2 states as follows: “The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and their physical environment from incidents” (Directive (EU) 2022/2555, Article 21, paragraph 2). For practical guidance in French, the 42 measures in the ANSSI guide to information security hygiene are a good starting point before covering all of Annex A.
Key point: ISO 27002 is not certifiable. It is a supporting standard. You do not get certified to “ISO 27002”; instead, you use it to implement correctly the controls selected as part of an ISMS compliant with ISO 27001.
What are the 4 control themes?
Organizational (37)
Policies, roles and responsibilities, asset management, supplier relationships, incident management and business continuity.
People-related (8)
Awareness, training, background checks, remote working, disciplinary processes and termination.
Physical (14)
Premises security, secure areas, equipment protection, storage media and maintenance.
Technological (34)
Access control, encryption, logging, malware protection, development security and network security.
| Theme | Number of controls |
|---|---|
| Organizational | 37 |
| People-related | 8 |
| Physical | 14 |
| Technological | 34 |
| Total | 93 |
How does it relate to Annex A of ISO 27001?
The 2022 revision fully aligned the two standards: the 93 controls in ISO 27002:2022 correspond one-to-one with the controls in Annex A of ISO 27001:2022. Annex A gives each control’s title and a brief description; ISO 27002 provides the complete instructions. In practice, you use ISO 27002 to justify, design and implement each control that your risk assessment led you to select for your Statement of Applicability (SoA).
Before 2022, the standard contained 114 controls in 14 categories; the 2022 revision consolidated them into 93 controls and 4 themes. The alignment described above has existed only since this edition.
What are the 5 attributes in the 2022 version?
A major new feature of the 2022 edition: each control now has 5 attributes that let you sort and filter it along different governance dimensions. These are: control type (preventive, detective, corrective), security properties (confidentiality, integrity, availability), cybersecurity concepts (identify, protect, detect, respond, recover), operational capabilities and security domains. They make it easier to map controls to other frameworks (NIST, etc.) and manage them.
How do you move from a control to implementation?
Start with risks
Identify the risks to address from the organization’s risk assessment in the ISMS.
Select controls
Choose from the 93 controls those that genuinely reduce your risks, and document the SoA.
Implement
Implement each control by following the detailed recommendations in ISO 27002.
Measure & improve
Evaluate control effectiveness and adjust controls as part of continual improvement.
Document (SoA)
Justify each included or excluded control in the Statement of Applicability, a central part of the audit.
Audit & review
Periodically review whether the controls remain appropriate as risks and context change.
Why work with BCIT?
Relevant selection
We help you choose the controls that matter to your risks, without unnecessary burden or blind spots.
Practical implementation
Operational implementation tailored to your tools, teams and actual maturity.
Robust SoA
A Statement of Applicability clear and defensible, ready for thecertification audit.
Need help selecting and implementing your controls?
BCIT Formation supports you in selecting and implementing ISO 27002 controls, in line with your ISMS — rated 4.7/5 on Trustpilot. Let’s discuss your situation.