ISO 27002 controls and requirements, turned into security your auditor can test.

What it is

What is ISO 27002 and what is it used for?

ISO/IEC 27002 is the international catalogue of information security controls, published jointly by ISO and IEC. Its full title is "Information security, cybersecurity and privacy protection — Information security controls". For each control it states the control itself and gives guidance on how an organisation can implement it, which is why security teams keep it open while they write policies, configure systems and brief suppliers.

Its most important job is as the companion to ISO/IEC 27001. The certifiable standard sets the requirements for an information security management system (ISMS) and asks you to decide your controls from your risk assessment; its Annex A lists 93 controls that are directly derived from, and aligned with, clauses 5 to 8 of ISO/IEC 27002. Annex A tells you what each control is. ISO/IEC 27002 tells you how to make it work. The sector standards ISO/IEC 27017 for cloud services and ISO/IEC 27018 for PII in public clouds are built on the same catalogue.

Current edition. ISO/IEC 27002:2022, the third edition, published in February 2022 with a corrected version in March 2022, replaced ISO/IEC 27002:2013. The 2022 catalogue reorganised the old 114 controls in 14 clauses into 93 controls in four themes. Certificates to ISO/IEC 27001:2013 lapsed on 31 October 2025, so every valid certificate now rests on the 2022 control set. ISO/IEC 27001 Annex A controls explained

Who it is for

Who needs ISO 27002?

Anyone responsible for making security controls real uses it: the ISMS manager, IT and cloud engineers, HR for people controls, facilities for physical ones, procurement for suppliers. Organisations bring it to Sterling from four starting points:

• A customer's security questionnaire asks for controls aligned with ISO 27002. The buyer wants to see access control, logging, backup and supplier management working, with evidence, not a policy set copied from the internet.
• A tender asks for ISO/IEC 27001. The certificate is issued against 27001, but the controls you implement and justify in your Statement of Applicability are the ones ISO/IEC 27002 explains.
• A regulator's framework is built on the catalogue. Several national and sector frameworks draw on ISO/IEC 27002; aligning with it first shortens the work for each of them.
• The group parent sets the control baseline. Subsidiaries adopt the parent's controls so that audit results and risk reports compare across countries.

Requirements

What are the ISO 27002 controls and requirements?

Strictly, ISO/IEC 27002 sets no requirements: it gives controls and guidance, and ISO/IEC 27001 sets the requirement to decide which controls you need. After its introductory clauses, the catalogue groups its 93 controls into four themes, one clause each. The list below is at theme level; your controls are compared with the standard itself, control by control, during the gap assessment.

• Clause 5 Organisational controls (37): policies, the asset inventory, access control, supplier and cloud relationships, incident management planning, ICT readiness for business continuity, legal requirements and the privacy of PII.
• Clause 6 People controls (8): screening, awareness and training, confidentiality agreements, remote working and the reporting of security events by staff.
• Clause 7 Physical controls (14): perimeters, physical entry, security monitoring of premises, clear desk and screen, assets taken off-premises and the secure disposal or re-use of equipment.
• Clause 8 Technological controls (34): user endpoints, privileged access, authentication, vulnerabilities, configuration, information deletion, data masking and leakage prevention, backup, logging, monitoring, web filtering and secure coding.
• New in the 2022 edition: 11 controls added, including threat intelligence, information security for use of cloud services, ICT readiness for business continuity, data leakage prevention and secure coding.

Putting it into practice

How do you implement ISO 27002 controls?

Because ISO/IEC 27002 is guidance, implementing it ends in controls that operate and records that prove it, not in a certificate of its own. Where a customer or regulator needs independent proof, the controls are run inside an ISO/IEC 27001 ISMS and that system is certified.

1. 01
   Set the scope and assess the risks.Agree the services, systems, sites and data in scope, then identify and evaluate the information security risks that matter to the business.
2. 02
   Gap assessment and control selection.We compare what operates today with the ISO/IEC 27002 guidance, decide the controls your risks require and record them, with reasons, in a Statement of Applicability.
3. 03
   Implement the controls and train the owners.Policies, technical settings, supplier terms and procedures put into use, each control with a named owner and the records it produces.
4. 04
   Audit internally and review the results.Internal audit samples the controls in operation; management reviews incidents, risk treatment progress and findings, and closes them with evidence.
5. 05
   Prove it, with ISO/IEC 27001 certification where needed.Share the evidence with customers, or ask an accredited certification body for its Stage 1 readiness review and Stage 2 audit of the ISMS; it makes the certification decision, then audits annually over a three-year cycle.

Check the route before you sign. A certificate "to ISO 27002" is not an accredited certificate, whatever the document says; ask what standard it is issued against and whether your customer will accept it. For ISO/IEC 27001, the certification body works to ISO/IEC 17021-1 and ISO/IEC 27006-1; confirm its accreditation for information security with an accreditation body recognised under the Global ACI arrangement. The certification buyer's checklist

Cost

How much does ISO 27002 implementation cost?

With no certification body for ISO/IEC 27002 itself, the budget is mostly consulting, your team's time and any technical changes the controls need. ISO/IEC 27001 certification, many systems or several countries add to it.

Timeline

How long does ISO 27002 implementation take?

Writing a control takes days; showing that it operates takes weeks of records, access reviews and restore tests. Existing security practice shortens the work, and so does an ISMS already in place. As an estimate, an implementation built on the controls typically takes four to eight months, with ISO/IEC 27001 certification adding the certification body's scheduling.

Your engagement

What your ISO 27002 engagement includes

Sterling OS™ runs every engagement, and each phase has a controls meaning. Sterling does not certify: where a certificate is needed, the accredited certification body audits your ISO/IEC 27001 system and makes the decision.

• Design™: guided support

  Your team writes the policies, procedures and Statement of Applicability; a Sterling consultant sets the method, interprets the guidance and reviews each draft.

• Drive™: managed support

  The alternative to Design™ for teams without spare capacity: Sterling drafts the controls and records with your owners and runs the programme to internal audit and review.

• Sustain™: after go-live or certification

  Internal audits, periodic control checks, risk reviews and preparation for customer audits or ISO/IEC 27001 surveillance.

• Automate™: Effivity

  Risks, the Statement of Applicability, incidents, audits and corrective actions run in Effivity, included with the engagement at no additional cost.

• Training for your people

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

Certification decisions remain with the independent certification body.

Often combined with

Standards organisations pair with ISO/IEC 27002

• ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
• CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
• CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
• CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
• Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
• DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.