ISO/IEC 27002
A guidance standard that provides detailed implementation advice for the information security controls that Annex A of ISO/IEC 27001 lists only as short titles.
ISO/IEC 27002 is the control catalogue of the ISO 27000 family. ISO/IEC 27001 sets the binding requirements for an information security management system (ISMS) and lists its controls in Annex A as little more than titles and one-line statements. ISO/IEC 27002 takes each of those controls and adds substance: its purpose, detailed implementation guidance and further explanatory notes. The current edition, ISO/IEC 27002:2022, is titled "Information security, cybersecurity and privacy protection — Information security controls" and is published in Germany as DIN EN ISO/IEC 27002.
The 2022 revision restructured the catalogue fundamentally. The former 114 controls in 14 clauses became 93 controls grouped into four themes: organisational, people, physical and technological. Eleven controls are entirely new, among them threat intelligence, information security for the use of cloud services, configuration management, information deletion, data leakage prevention, monitoring activities and secure coding. Every control also carries five attributes (control type, information security properties, cybersecurity concepts, operational capabilities and security domains), which allow an organisation to filter the catalogue along its own criteria and to map it onto other frameworks such as the NIST Cybersecurity Framework. Annex A of ISO/IEC 27001:2022 was aligned one-to-one with this structure.
One practical point matters above all: ISO/IEC 27002 is guidance and cannot itself be certified against — certification is always issued against ISO/IEC 27001. Nor does the standard oblige anyone to implement all 93 controls; applicability follows from the organisation's risk treatment and is justified in the Statement of Applicability. For entities in scope of the German BSIG as amended by the NIS2 implementation act, or for financial entities under DORA, the catalogue is a well-established source for translating regulatory expectations into concrete technical and organisational measures — but conformity with the standard never replaces an independent assessment of the statutory duties themselves.
Legal Basis
ISO/IEC 27002:2022 (DIN EN ISO/IEC 27002); related to ISO/IEC 27001:2022 Annex A
Practical Example
A mid-sized machinery manufacturer has maintained its Statement of Applicability since 2019 in the old ISO/IEC 27002 structure and has to migrate it to the 2022 edition now that the transition period has ended. The information security officer uses the official mapping table in Annex B of ISO/IEC 27002:2022 to trace the 114 legacy controls onto the 93 current ones. Three genuine gaps surface in the process, none of them previously covered by any internal rule: threat intelligence, security requirements for cloud services and data leakage prevention. For each gap the officer derives concrete measures from the standard's implementation guidance, assigns owners and deadlines in the treatment plan, and records the decision together with its underlying risk — so the next surveillance audit can follow the update without a single missing link.