iso iec 27002 is an international standard that specifies best practices for implementing information security controls within an organization's information security management system (ISMS), serving as a practical companion to iso iec 27001.
Developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), iso iec 27002 offers detailed guidance on how to apply security controls across 14 thematic domains. These domains cover areas such as access control, cryptography, incident management, and supplier relationships. The standard is not a standalone compliance requirement but a reference for designing, implementing, and maintaining effective security measures.
Organizations use iso iec 27002 to align their security practices with global benchmarks. It supports audits against iso iec 27001, which sets the structure for establishing, maintaining, and improving an ISMS. While iso iec 27001 defines "what" to do, iso iec 27002 explains "how" to do it.
The standard organizes security requirements into 14 control domains grouped by function. Each domain contains specific controls, numbered and labeled for clarity. For example, the Access Control domain includes controls like "AU-1: Access control policy," "AC-1: User access management," and "AC-2: Authentication."
Each control includes a purpose statement, implementation guidance, and optional assessment methods. This structure allows organizations to tailor implementations to their size, industry, and risk profile. A small healthcare provider may implement basic access logging, while a financial institution applies multi-factor authentication and continuous monitoring.
iso iec 27002 is updated periodically. The current version, published in 2022, replaced the 2013 edition. The update removed outdated terminology, streamlined control structures, and introduced clearer language. It also expanded focus on emerging threats like cloud security and supply chain risks.
iso iec 27002 divides security controls into 14 domains. Below is a breakdown of each domain, its primary focus, and a representative control.
| Domain | Focus Area | Example Control |
|---|---|---|
| Access Control | User authentication and authorization | AC-2: Authentication |
| Cryptography | Data confidentiality and integrity | CM-1: Cryptographic key management |
| Incident Management | Detection, reporting, and response | IM-1: Incident response plan |
| Supplier Relationships | Third-party risk mitigation | SR-1: Supplier risk assessment |
| Monitoring and Logging | Security event tracking | ML-1: Log management |
| Asset Management | Identification and protection of assets | AM-1: Asset inventory |
| Human Resources Security | Security during employment lifecycle | HR-1: Background checks |
| Physical and Environmental Security | Protection of facilities and equipment | PE-1: Secure facility access |
| Information Security Policies | Formalized governance and direction | PS-1: Information security policy |
| Business Continuity | Resilience during disruption | BC-1: Business continuity planning |
| Compliance | Legal and regulatory alignment | CO-1: Compliance with laws and regulations |
| System Development and Maintenance | Secure software lifecycle | SD-1: Secure development practices |
| Network Security | Protection of network infrastructure | NS-1: Network segmentation |
| Security Governance | Leadership and accountability | SG-1: Information security roles and responsibilities |
These domains reflect evolving cyber threats. For instance, the inclusion of "supplier relationships" addresses supply chain attacks like SolarWinds, where malicious code was injected through trusted vendors.
iso iec 27002 is not a certification standard. Organizations cannot achieve "iso iec 27002 certification." Certification requires iso iec 27001, which evaluates whether an ISMS meets specified criteria. iso iec 27002 supports that process but does not replace it.
Another misunderstanding is that all controls in iso iec 27002 must be implemented. That is incorrect. The standard is advisory. Organizations select controls based on risk assessments and business context. A retail store may skip advanced cryptographic controls if it doesn't handle sensitive payment data.
A less obvious point: iso iec 27002 does not define metrics for measuring control effectiveness. It describes what to do, but not how to track success. Organizations must supplement it with internal KPIs, such as time-to-detect incidents or percentage of systems patched within SLAs.
A mid-sized SaaS company preparing for iso iec 27001 certification used iso iec 27002 to build its control baseline. They focused on five domains: Access Control, Cryptography, Incident Management, Supplier Relationships, and Monitoring.
For Access Control (domain AC), they implemented role-based access and mandatory MFA for all employees. They documented policies and trained staff using the guidance in control AC-2. This reduced unauthorized access attempts by 78% over six months.
In Cryptography (CM), they adopted AES-256 encryption for data at rest and TLS 1.3 for data in transit. They aligned with CM-1 by creating a key rotation schedule and storing keys in a hardware security module (HSM).
When responding to a phishing attack that compromised two employee accounts, the team activated the incident response plan (IM-1). Within 45 minutes, they isolated affected systems, reset passwords, and notified stakeholders. Post-incident review showed that following iso iec 27002 guidance reduced recovery time by 40% compared to previous ad hoc responses.
They also assessed third-party risks using SR-1. Before onboarding a new cloud storage vendor, they reviewed the vendor's security posture, verified audit reports, and included contractual obligations for data handling. This prevented a potential breach linked to weak vendor controls.
Understanding iso iec 27002 is essential for any organization aiming to strengthen its information security posture. It provides a structured, globally recognized approach to managing cyber risks. By selecting and tailoring controls to fit operational realities, teams turn abstract principles into measurable actions.
Implementing iso iec 27002 correctly begins with a risk assessment, not a checklist. The goal is not compliance for its own sake, but resilience. As one security lead noted after a successful audit: "The real value wasn't passing the test-it was realizing we had blind spots we didn't know existed."