# ISO/IEC 27002: Information security controls guidance

> Implementation guidance for the 93 controls referenced in ISO/IEC 27001 Annex A.

URL: https://securei3.com/standards/iso-27002/
Category: Information security & privacy: Guidance standard
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


ISO/IEC 27002:2022 explains the purpose of each information security control and how to implement it, organised into organisational, people, physical and technological themes with attributes such as control type and cybersecurity concept. We use it to design controls that are proportionate and auditable.

## Who it is for

- Security teams implementing ISO 27001
- Organisations benchmarking security controls

## Benefits

- Practical guidance on each control
- Attributes that help map to NIST CSF and other frameworks

## How Secure iQube helps

1. **Maturity review**: Assess current practice against the guidance and agree what good looks like for your organisation.
2. **Framework design**: Translate the principles into a practical framework, roles and tools that fit your existing management systems.
3. **Embedding**: Workshops and coaching so teams apply the framework in day-to-day decisions.
4. **Review and reporting**: Periodic reviews and reporting that show progress to leadership and stakeholders.

## Frequently asked questions

### Can we certify to ISO 27002?

No. ISO 27002 is guidance; certification is against ISO/IEC 27001.

Related: https://securei3.com/standards/iso-27001/, https://securei3.com/standards/iso-27005/

Contact: https://securei3.com/contact/: info@securei3.com