ISO/IEC 27002

ISO/IEC 27002:2022 is the companion code of practice to ISO/IEC 27001, providing detailed implementation guidance for the same 93 security controls referenced in Annex A, organized into four themes: organizational, people, physical, and technological. It is not itself a certifiable standard — a company gets certified to ISO/IEC 27001, not to 27002 — so it functions as the practical reference companies use when deciding how to actually implement the controls their ISMS requires. The 2022 revision consolidated the prior 114 controls into 93 and added 11 new ones covering areas like threat intelligence, cloud security, and data masking.