ISO 27002: The 93 Security Controls Explained for IT Teams

ISO/IEC 27002 is the guidance document that explains the security controls behind ISO 27001. The current edition, ISO/IEC 27002:2022, contains 93 controls grouped into four themes. It is voluntary and not certifiable: organisations are certified to ISO 27001, and use ISO 27002 to decide how to implement the controls that ISO 27001 Annex A lists.

What is ISO 27002?

ISO 27002 is a code of practice. For every control it gives:

• The control: what should be in place, in one or two sentences.
• Purpose: why the control exists and which risk it reduces.
• Guidance: how it is usually implemented, often several pages for a single control.
• Other information: related standards and points to consider.

ISO 27001 Annex A uses the same control numbers and titles as ISO 27002, but only states each control briefly. An auditor checks your ISMS against ISO 27001. When you need to know what “secure coding” (8.28) or “threat intelligence” (5.7) should look like in practice, you read ISO 27002.

Is ISO 27002 a standard you can be certified against? No. The text uses “should”, not “shall”. It describes good practice and leaves you to decide which controls apply and how far to go, based on your risk assessment.

History and why it was introduced

The 2022 rewrite was introduced because the 2013 structure no longer matched how organisations work. Cloud services, remote work, threat intelligence, data leakage and secure coding were missing or thin, and the 14 domains made controls hard to map to other frameworks. Many controls were merged, so the count fell from 114 to 93 even though coverage grew.

Main objectives:

1. Give organisations a shared, internationally agreed set of security controls.
2. Explain the purpose of each control so it is applied according to risk, not ticked off.
3. Make controls easy to map to other frameworks through attributes.
4. Support implementation of an ISO 27001 information security management system.

Who needs ISO 27002?

No one is legally required to follow ISO 27002. In practice it is used by:

Industries: software and SaaS, IT services and outsourcing, banking and insurance suppliers, healthcare technology, telecoms and the public sector.

Geography: used worldwide. Many national standards bodies publish it under their own reference, for example IS/ISO/IEC 27002 in India, BS EN ISO/IEC 27002 in the UK and DIN EN ISO/IEC 27002 in Germany.

Is ISO 27002 mandatory?

No. It is voluntary guidance. Three things can make it feel mandatory:

• ISO 27001 certification. You must compare your risk treatment with every control in Annex A and justify exclusions. ISO 27002 is the obvious reference, though you are not audited against its guidance text.
• Contracts. Customers sometimes write “controls aligned with ISO/IEC 27002” into supplier agreements.
• Regulators. Some regulators refer to it as a recognised good practice. For example, the RBI and SEBI frameworks in India and many public-sector security policies borrow its structure.

Key requirements: the 93 controls

The 2022 edition groups controls into four themes, numbered by clause.

The 11 new controls in 2022

Control attributes

Each control is tagged with five attributes so you can filter and map them:

Attributes help when a customer asks “show us your detective controls” or when you map controls to NIST CSF.

How to implement ISO 27002

1. Start from risk. List your information assets and the risks to them. ISO 27002 controls are answers to risks, not a shopping list.
2. Build a control matrix. For each of the 93 controls, record whether it applies, who owns it, how it is implemented and where the evidence lives. This becomes your Statement of Applicability if you pursue ISO 27001.
3. Read the guidance for each applicable control and decide what is proportionate. A 20-person SaaS company and a bank will implement 8.16 (monitoring) very differently.
4. Write short policies and procedures that reflect what you actually do. ISO 27002 guidance often suggests topic-specific policies, such as access control, cryptography and secure development.
5. Implement technical controls in your platforms: identity provider, device management, cloud configuration, logging, backups and CI/CD.
6. Collect evidence as you go: screenshots, tickets, logs, reports and review records.
7. Review regularly. Controls drift as systems change. Check them at least yearly and after major changes.

Documentation and policies

ISO 27002 doesn’t set a list of mandatory documents (ISO 27001 does). Its guidance commonly points to:

• An overall information security policy and topic-specific policies (access control, acceptable use, cryptography, backup, secure development, supplier security, incident management, mobile and remote working)
• An inventory of information and other associated assets
• Classification and labelling rules
• Roles and responsibilities, including segregation of duties
• Supplier agreements with security clauses
• Incident response procedures and records
• Secure configuration baselines
• Logging and monitoring procedures
• Business continuity and ICT recovery plans

Audits and assessments

You can’t be certified to ISO 27002, so there is no ISO 27002 audit in the formal sense. Where you will meet it:

• ISO 27001 certification audits. Auditors use their knowledge of ISO 27002 to judge whether a control is effective, but they audit against ISO 27001’s requirements and your own policies.
• Customer assessments. Questionnaires often list ISO 27002 control numbers.
• Internal audits and gap assessments. A useful way to measure maturity before a certification project.

Be careful with any “ISO 27002 certificate” offered for sale. It isn’t an accredited certification.

Cost

There is no certification fee because there is no certificate. Costs come from:

Benefits

• A clear, internationally recognised description of what good security looks like.
• Faster ISO 27001 preparation, because Annex A and ISO 27002 use the same numbering.
• Easier questionnaire answers: one control set mapped once, reused many times.
• Attributes make it simpler to map to NIST CSF, SOC 2 and other frameworks.
• Shared language between security, engineering, auditors and customers.

Risks of ignoring it

• Controls designed without reference to good practice tend to have gaps that auditors and attackers find.
• ISO 27001 projects take longer when teams have to reinvent each control.
• Security questionnaires take more effort when you have no structured control catalogue.

Common mistakes

• Treating it as a checklist. Implementing all 93 controls the same way regardless of risk wastes effort and still misses real threats.
• Copying policy templates that describe controls you don’t run. Auditors ask for evidence.
• Using the 2013 numbering. Questionnaires and old templates still use A.5 to A.18; the 2022 numbering is clauses 5 to 8.
• Ignoring the new controls, especially configuration management, data masking and secure coding, which matter most for software companies.
• Buying an “ISO 27002 certificate”, which has no accredited standing.

Challenges for IT companies

• Cloud-first set-ups. Many physical controls apply only to offices and must be adapted for remote teams, while your cloud provider covers its data centres.
• Developer workflows. Secure development controls (8.25 to 8.31) need to fit into CI/CD without slowing releases.
• Evidence across many tools. Controls are spread over identity, cloud, code and ticketing platforms.
• Small teams. Segregation of duties is hard with five engineers; compensating controls such as peer review and logging help.

Best practices

• Use the attributes to group controls by owner, so each team sees only its own.
• Map ISO 27002 once to the other frameworks you need, such as SOC 2 and CIS Controls.
• Automate evidence where possible, for example configuration checks and access reviews.
• Write policies in plain language and keep them short.
• Use the cloud-specific guidance in ISO 27017 and privacy guidance in ISO 27018 where relevant.

Tools that help

How ISO 27002 relates to other frameworks

Real-world examples

• Security questionnaires. Standard questionnaires used in vendor reviews commonly include mappings to ISO 27002 control numbers.
• Indian regulators. Cybersecurity frameworks from Indian financial regulators draw on ISO 27001 and 27002 concepts, and many Indian IT service providers align their control libraries with ISO 27002 numbering.
• Illustrative scenario, not a real company: a 15-person software agency uses ISO 27002 to build a one-page control matrix before its first enterprise contract. It focuses on access control, device management, secure coding, backups and supplier security, and is ready for an ISO 27001 project a year later.

Frequently asked questions

Can my company be ISO 27002 certified? No. ISO 27002 is guidance. Certification is to ISO 27001.

How many controls are in ISO 27002:2022? 93, in four themes: 37 organisational, 8 people, 14 physical and 34 technological.

What is the difference between ISO 27001 and ISO 27002? ISO 27001 sets out the management system requirements and lists the controls briefly in Annex A. ISO 27002 explains each control in detail. You are certified against ISO 27001.

Is ISO 27002:2013 still valid? It has been withdrawn and replaced by the 2022 edition. ISO 27001 certificates to the 2013 edition expired on 31 October 2025.

Do I need to buy ISO 27002? It is copyrighted and sold by ISO and national standards bodies. If you are implementing ISO 27001, it is worth having.

What are the new controls in ISO 27002:2022? Threat intelligence, cloud services security, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.

Does ISO 27002 cover privacy? Partly, through controls such as 5.34 (privacy and protection of personal information). For a full privacy management system, see ISO 27701.

Can a small company use ISO 27002? Yes. It is guidance, so you apply what is proportionate to your size and risk.

Next steps

• Build a control matrix for the 93 controls and mark which apply to you.
• Read the ISO 27002 guidance for the 11 new controls first.
• Map your matrix to any other frameworks customers ask about.
• Decide whether to go for ISO 27001 certification.