ISO 27002 and how it relates to ISO 27001

ISO/IEC 27002:2022 is the guidance document behind ISO 27001’s Annex A. It describes the same 93 controls, numbered identically, and for each gives a purpose, implementation guidance and five attributes for sorting them. You cannot be certified to ISO 27002; you use it to implement the controls you are certified against in ISO 27001.

The requirement in plain English

ISO 27002 sets no requirements of its own. Its job is to explain the controls that ISO 27001 lists in Annex A, so the two editions travel together: ISO 27002:2022 was published in February 2022, and ISO 27001:2022 followed in October 2022 with an Annex A drawn directly from it.

Structure. The first four clauses cover scope, references, terms and how the document works. Clauses 5 to 8 hold the controls in the same four themes as Annex A: 37 organisational, 8 people, 14 physical and 34 technological, 93 in total. The numbering is one-to-one, so ISO 27002:2022 5.15 is the guidance for ISO 27001:2022 Annex A 5.15. Annex A of ISO 27002 explains how to use the attributes; Annex B maps the 2022 controls to the 2013 ones.

Each control has a short title, a table of attributes, the control itself, its purpose, guidance on implementing it, and other information. The guidance uses “should”, not “shall”: it is a set of recommendations, and you choose what fits your risks.

Five attributes tag every control, so you can sort and filter the set:

1. control type: preventive, detective or corrective;
2. information security properties: confidentiality, integrity and availability;
3. cybersecurity concepts: identify, protect, detect, respond and recover;
4. operational capabilities, such as asset management, identity and access management or supplier relationships security;
5. security domains: governance and ecosystem, protection, defence, and resilience.

The 2022 edition added 11 controls with no 2013 equivalent, such as secure coding (ISO 27002:2022 8.28), and merged many of the 2013 edition’s controls into fewer, broader ones.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 30-person company preparing for ISO 27001 buys both documents. ISO 27001 sets what it must do; ISO 27002 is open on the security lead’s desk whenever a topic-specific policy is written.

When the team writes its access control policy, it reads the guidance for access control (ISO 27002:2022 5.15) and checks the draft covers what the guidance raises: business and security requirements, need to know, least privilege, and how rules are reviewed. Where the team chooses a different approach, the reason is recorded. When it adopts cloud services, the guidance for cloud (ISO 27002:2022 5.23) shapes its supplier review and exit planning for the matching Annex A control (ISO 27001:2022 Annex A 5.23).

The attributes earn their keep in two places. Filtering by cybersecurity concept shows whether the control set is weighted towards protect and weak on detect or recover, which feeds the next risk review. Filtering by operational capability gives each control owner a clean list of what they look after.

When a customer asks how the controls map to another framework, the attributes give a starting point, because the cybersecurity concepts follow the same functions many frameworks use.

Evidence an auditor expects

• Your ISO 27001 Statement of Applicability: the auditor audits against ISO 27001 and your own SoA, not against ISO 27002.
• Topic-specific policies and procedures: the auditor may use ISO 27002 as a reference for what a reasonable implementation looks like, and asks why where yours differs.
• Records of choices against the guidance: usual rather than required; a short note where you chose a different approach shows the decision was deliberate.
• The check against Annex A (ISO 27001:2022 6.1.3 c)): the auditor confirms you compared your controls with Annex A; ISO 27002 explains each one you compared.

Common mistakes

Claiming ISO 27002 certification

No such certificate exists. Say you are certified to ISO 27001 and that your controls follow ISO 27002 guidance where that is true.

Treating every “should” as a “shall”

Teams new to the standard implement every line of guidance and build far more than their risks need. The guidance is a menu of good practice. Decide what your risks call for, and record why.

Mixing 2013 and 2022 numbering

Old policies cite 2013 clause numbers that now point to different controls or none. Use the correspondence table in ISO 27002 to update references in one pass, then retire the old numbers.

Ignoring the attributes

The attributes are optional, but teams that skip them miss the quickest way to see gaps by function. A single sort by cybersecurity concept is worth an hour of anyone’s time.

Reading only the control sentence

Annex A gives one or two sentences; the purpose and guidance in ISO 27002 are what explain what an auditor will expect. Read the whole entry before you decide a control does not apply.

How Sted helps

Related guides and terms

• ISO 27001: the hub for the standard you are certified against.
• The Statement of Applicability: where your choice of controls is recorded.
• Annex A organisational controls, physical controls and technological controls: the controls grouped by purpose.
• SOC 2: another framework whose criteria overlap the same controls.
• Annex A: the term, and what normative means for it.

Frequently asked questions