ISO/IEC 27002:2022 explains the purpose of each information security control and how to implement it, organised into organisational, people, physical and technological themes with attributes such as control type and cybersecurity concept. We use it to design controls that are proportionate and auditable.
Who it is for
- Security teams implementing ISO 27001
- Organisations benchmarking security controls
What you gain
- Practical guidance on each control
- Attributes that help map to NIST CSF and other frameworks
How we help you apply it
Maturity review
Assess current practice against the guidance and agree what good looks like for your organisation.
Framework design
Translate the principles into a practical framework, roles and tools that fit your existing management systems.
Embedding
Workshops and coaching so teams apply the framework in day-to-day decisions.
Review and reporting
Periodic reviews and reporting that show progress to leadership and stakeholders.
ISO/IEC 27002 questions
Can we certify to ISO 27002?
No. ISO 27002 is guidance; certification is against ISO/IEC 27001.