ISO 27002:2022 Explained: Control Guidance and How It Relates to ISO 27001

ISO 27002 (ISO/IEC 27002:2022) is the international guidance standard for information security controls. It describes 93 controls, the same 93 listed in Annex A of ISO 27001, and for each one explains its purpose and how to implement it. You cannot be certified to ISO 27002: organisations certify to ISO 27001 and use ISO 27002 as the detailed reference for the controls they choose.

This guide explains how ISO 27002:2022 is structured, how its attributes work, how it differs from ISO 27001 and how implementers and auditors use it. It is written by Sovereign Secure, an ISO 27001-certified UK consultancy.

What is ISO 27002?

ISO/IEC 27002 is a reference set of information security controls with implementation guidance, published jointly by ISO and the International Electrotechnical Commission (IEC). The current edition, ISO/IEC 27002:2022, was published in February 2022 with the title “Information security, cybersecurity and privacy protection: Information security controls”. It replaced the 2013 edition.

The standard descends from British Standard BS 7799, whose first part became ISO/IEC 17799 and was renumbered ISO/IEC 27002 in 2007.

ISO 27002 is written in terms of “should”, not “shall”: it recommends rather than requires. That makes it useful in three ways:

• as the implementation reference for the controls an ISO 27001 ISMS selects;
• as a control baseline for organisations that are not seeking certification;
• as the base for sector guidance, such as ISO/IEC 27017 for cloud services.

Can you get certified to ISO 27002?

No. ISO 27002 contains guidance, not requirements, so there is nothing for a certification body to audit against. Certification is to ISO 27001, which sets the requirements for the whole management system and uses the 27002 controls as its Annex A.

If a supplier describes itself as “ISO 27002 certified”, ask for its ISO 27001 certificate and its Statement of Applicability, which together show what is certified and which controls are actually in place.

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 says what your management system must do; ISO 27002 explains why each control matters and how to put it in place.

The two are always read together. ISO 27001 clause 6.1.3 c) requires you to compare the controls you have chosen with Annex A, and Annex A takes its control list directly from ISO 27002. For the full picture of the certifiable standard, see What is ISO 27001?

How are the ISO 27002 controls structured?

Clauses 0 to 4 introduce the document. The controls sit in clauses 5 to 8, grouped into four themes. Annex A explains how to use attributes, and Annex B maps the 2022 controls to the 2013 edition.

Every control follows the same layout:

• Attribute table: the control’s values for each of the five attribute types.
• Control: what the control is. ISO 27001 Annex A uses essentially the same wording, with “shall” in place of “should”.
• Purpose: why the control exists. Every control gained a purpose statement in 2022.
• Guidance: how to implement it, often over several paragraphs.
• Other information: background, related standards and caveats.

Our guide to ISO 27001 Annex A controls explains every control in plain English.

What are the attributes in ISO 27002?

Attributes are tags that let you sort and filter the 93 controls from different points of view. There are five attribute types, each with a fixed set of values written as hashtags.

Attributes are optional, but they are useful for:

• Checking coverage. Filter for #Detective to see whether you can spot incidents as well as prevent them, or for #Availability when planning continuity work.
• Reporting to different audiences. Group controls by security domain for the board and by operational capability for the teams that run them.
• Mapping to other frameworks. The cybersecurity concepts match the five functions of version 1.1 of the NIST Cybersecurity Framework; NIST CSF 2.0, published in 2024, adds a sixth, Govern.

ISO 27002 also allows organisations to define their own attributes, such as asset type or control owner, to suit how they manage their controls.

What changed in ISO 27002:2022?

The 2022 edition restructured the controls rather than adding many new ones.

The 11 new controls are 5.7 threat intelligence, 5.23 information security for use of cloud services, 5.30 ICT readiness for business continuity, 7.4 physical security monitoring, 8.9 configuration management, 8.10 information deletion, 8.11 data masking, 8.12 data leakage prevention, 8.16 monitoring activities, 8.23 web filtering and 8.28 secure coding. The other 82 carry forward the content of the 2013 controls, many of them merged or renamed. Annex B of ISO 27002 maps every 2013 control to its 2022 equivalent, which is the table to work from if you still have documents built on the old A.5 to A.18 numbering.

What is ISO 27002 used for?

ISO 27002 is used to design, implement and assess information security controls. Implementers use it to build controls, certification auditors use it to understand what a control is meant to achieve, and customers and suppliers use its control names as a shared language.

Implementers read the 27002 guidance for each control their Statement of Applicability marks as applicable, then decide what is proportionate. The guidance is not a checklist. A 20-person firm does not need every logging measure a bank would run, provided its implementation meets the control statement and treats the risks identified in its ISO 27001 risk assessment.

Certification auditors audit against the ISO 27001 requirements and against your own SoA, policies and risk treatment plan. They use ISO 27002 to understand the intent of a control and to judge whether your implementation achieves it. Departing from a piece of 27002 guidance is not, on its own, a nonconformity, but you should be able to explain how your approach meets the control.

Customers and suppliers use the 27002 control names as a common language in security questionnaires and contracts, which is why the same numbering turns up in supplier assessments.

Where does ISO 27002 sit in the ISO/IEC 27000 family?

ISO 27002 is the control catalogue of the ISO/IEC 27000 family. Some members set requirements, some give guidance on the management system, and some extend the 27002 controls for particular settings.

Do you need to buy ISO 27002?

Not for certification. Annex A of ISO 27001 contains the control statements, and the certification body audits against ISO 27001. In practice, most people implementing an ISMS find the 27002 guidance worth having, especially for controls they have not run before. Both standards are copyright documents sold by ISO and by national standards bodies such as BSI in the UK.

Why Sovereign Secure

• ISO 27001 certified ourselves, so we use ISO 27002 the way auditors expect: as guidance to meet each control proportionately, not as a list to copy.
• Controls designed from your risks through our ISO 27001 consultancy, from risk assessment and Statement of Applicability to working procedures. Certification audits are carried out by an independent certification body, our partner MQA International.
• One control set for several schemes. As a PCI SSC Qualified Security Assessor (QSA) company and an IASME-licensed Cyber Essentials certification body, we map 27002 controls to PCI DSS v4.0.1 and Cyber Essentials, so evidence gathered once can be reused wherever the requirements overlap.
• Technical evidence in-house for controls such as 8.8 and 8.29, from penetration testing to vulnerability scanning.
• UK company since 2012, headquartered in Accrington, Lancashire.

Next step

If you are working out which 27002 controls apply to you and how far to take them, our ISO 27001 consultancy can run the risk assessment and build the Statement of Applicability with you. Use the form below, which is already set to ISO 27001, or call +44 161 523 5276.