ISO 27002.
Guidance for information security controls: what ISO 27002 organises, how to apply it and what evidence results.
- ISO/IEC 27002:2022
- By Jonathan Bezdek
- As of: 10/22/2026
- Reading time: 7 min.
Short answer.
ISO 27002 is the international implementation guide for information security controls. ISO/IEC 27002:2022 organises controls into organisational, people, physical and technological themes and explains their application. Organisations use the guidance according to their risks and operations. There is no standalone ISO 27002 certification; ISO 27001 contains certifiable ISMS requirements.
ISO 27002:2022 as implementation guidance.
ISO 27002 explains security controls, while ISO 27001 describes requirements for an information security management system, or ISMS. Controls are measures for influencing security risks. They include organisational processes as well as technical or physical arrangements. A control catalogue therefore describes neither simply a product list nor only the work of an IT department.
The publisher's public page lists ISO/IEC 27002:2022 as the third edition, dated February 2022, and notes a corrected English version from March 2022. The editors' article in the December 2022 SC 27 Journal, pages 13 to 15, explains the structure of 93 controls across four themes and the supplementary attributes. This orientation does not replace using a lawfully obtained copy of the standard.
The guidance is applied in the organisation's own context. The IEC product description mentions both use within an ISMS and development of organisation-specific security guidelines. Adopting a catalogue alone does not determine which environment is protected, who operates a control or whether it actually works.
Who ISO 27002 is suitable for.
According to ISO's public description, ISO 27002 is intended for organisations of different sizes and sectors. It can support control work in an existing ISMS or guide security work. Seeking certification is not a prerequisite. Before introduction, clarify whether the need is for a shared professional language, better implementation or evidence for a particular recipient.
Several functions are regularly involved in application. As a practical division of work, security owners can coordinate selection, service owners explain the affected environment and business functions implement controls. Procurement, HR, facilities and development are involved where a particular control touches their processes. This division is a recommendation for organising work, rather than a universally prescribed allocation of roles from the standard.
ISO 27002 controls as a working basis.
Four themes structure the controls; selection and attributes assist their application. The following six work areas connect that structure with practical decisions, without representing six official standard sections or a complete control list.
Organisational responsibility.
Organisational controls form a theme in their own right. For practical implementation, clarify where a decision is made, approved and reviewed. An understandable arrangement connects the protected service with the responsible function; the mere existence of a policy document does not explain that connection.
People and workflows.
People controls consider security in relation to people and their work. When applying them, examine which everyday events trigger an action and who performs it. Training and a role change require different implementations, even when the same business function supports both.
Physical environment.
Physical controls concern the environment where information and supporting assets are used. In defining practical boundaries, distinguish your own sites from service providers' facilities and services. Evidence about a data centre, for example, does not automatically answer questions about handling devices in your own office.
Technological implementation.
Technological controls form the fourth theme. To apply them, first describe which systems and information a technical arrangement should cover. You can then examine whether configuration, operating procedures and monitoring align. An enabled feature is a starting point for examination, rather than a complete statement of effectiveness.
Connect selection with risk.
Application should start from the protection needs and risks of the operations concerned. As a practical recommendation, record the decision supporting a control and the dependencies considered. This makes it clear why two services may need different implementations even when the same guideline provides orientation.
Use attributes for understandable views.
According to the editors' article, attributes enable different views of the control set. Use such views, for example, to coordinate security and operational owners. Sorting makes navigation easier; it replaces neither an applicability decision nor evidence that a control is implemented or effective.
Apply ISO 27002 in operations.
Choose a manageable scope.
As a practical starting point, define a service with its information, systems and participants, so that subsequent implementation has a verifiable boundary.
Record the decision basis.
Describe relevant risks and business, legal or contractual requirements before drawing on suitable guidance for control work.
Read the guidance in context.
Use a lawfully obtained standard to assess which guidance fits your environment, and do not treat a brief description as a complete implementation requirement.
Determine implementation and responsibility.
Agree what should happen in the operations concerned, who is responsible and which existing process the work connects to.
Check the statement against evidence.
Choose records or tests that actually cover the described scope, and record the result, examination date and necessary follow-up measures.
Reassess changes.
Define appropriate review triggers, such as a changed service or an incident, and update the implementation decision with the affected owners.
Evidence without an ISO 27002 certificate.
According to the ISO product FAQ, standalone ISO 27002 certification is not provided for. Those needing certified ISMS evidence should consider ISO 27001 and the specific certification scope. ISO itself does not perform such certifications; according to its certification page, external bodies do so. The implementation guide therefore has no general certificate validity period either.
For your own evidence work, formulate a clear statement: which implementation in which environment is to be demonstrated? A procedure can describe the planned working method, while a record demonstrates its execution. A test in turn examines a specific expectation. These forms of evidence can complement one another but answer different questions.
Before sharing evidence, check its origin, period and scope. A current setting does not demonstrate historical operation; a sample does not automatically explain every exception. Document limited coverage and resulting work, rather than deriving a complete security or conformity assurance from a single record.
Understanding other frameworks.
ISO 27001 describes ISMS requirements; ISO 27002 supports control work within it. IT-Grundschutz provides its own BSI methodology with standards and a Compendium. Statutory BSIG duties for entities in scope still require separate examination; using implementation guidance does not confirm NIS2 compliance.
In Secani.
Secani includes an editorial work catalogue for ISO/IEC 27002:2022, with profile information on cloud services, software development and mobile working, among other areas. The catalogue supports structured work and is not an official standard text. Applicability decisions need justification; the editorial aid does not replace independent professional assessment.
Start with traceable implementation.
Choose a service whose owners and dependencies are known. Record a specific security decision with its trigger, intended implementation and suitable verification route. Then clarify with participants whether this description matches work as actually performed. Only then can the approach usefully be extended to other services.
Frequently asked questions.
No. ISO 27002 is implementation guidance; ISO 27001 is the relevant requirements standard for certified evidence of an information security management system.
No. Specific implementation depends on the context and risks of the environment concerned; a shared reference does not mean an identical operating model for every organisation.
No. Attributes enable different views of controls and help organise them; they replace neither an applicability decision nor implementation evidence.
No. An understandable policy or operational procedure can support several controls, provided each implementation and responsibility remains traceable.
Manage controls with a clear audit trail.
Organise risks, responsibility and evidence in Secani.
This page provides context on the implementation guide. Lawfully obtained standards and the specific application context take precedence.