ISO/IEC 27002 (2022)

ISO/IEC 27002 is an international standard published jointly by ISO and IEC that provides a reference set of information security controls together with detailed implementation guidance. The 2022 edition reorganised the controls into four themes (organisational, people, physical and technological) and introduced attributes that help organisations map, filter and prioritise controls. It gives practical detail on how the controls referenced by ISO/IEC 27001 Annex A can be designed and operated.

Unlike ISO/IEC 27001, ISO/IEC 27002 is a code of practice and guidance document rather than a set of certifiable requirements, so organisations cannot be certified against it directly. Instead it underpins the selection, implementation and improvement of controls within an information security management system. The current edition is ISO/IEC 27002:2022, published in February 2022.