{"history":[],"article":{"id":"e8eb7e0a-4206-4a8c-ba15-bc8849821b55","title":"ISO/IEC 27002","slug":"iso-iec-27002","content":":::summary\n**Title:** ISO/IEC 27002 \n**Domain:** [Information security management](https://bliptext.com/articles/information-security-management) \n**Status:** Published \n**Organization:** [International Organization for Standardization](https://bliptext.com/articles/international-organization-for-standardization) \n**Series:** [ISO/IEC 27000 family](https://bliptext.com/articles/iso-iec-27000-family) \n**Version:** 3 \n**Version Date:** Mar 2022 \n**Committee:** [ISO/IEC JTC 1/SC 27](https://bliptext.com/articles/undefined) \n:::\n\n# \n**ISO/IEC 27002** is an [information security](https://bliptext.com/articles/information-security) [standard](https://bliptext.com/articles/international-standard) published by the [International Organization for Standardization](https://bliptext.com/articles/international-organization-for-standardization) (ISO) and by the [International Electrotechnical Commission](https://bliptext.com/articles/international-electrotechnical-commission) (IEC), titled Information security, cybersecurity and privacy protection — Information security controls.\nThe [ISO/IEC 27000 family](https://bliptext.com/articles/iso-iec-27000-family) of standards are descended from a corporate security standard donated by [Shell](https://bliptext.com/articles/royal-dutch-shell) to a UK government initiative in the early 1990s.\nThe Shell standard was developed into British Standard BS 7799 in the mid-1990s, and was adopted as ISO/IEC 17799 in 2000.\nThe ISO/IEC standard was revised in 2005, and renumbered ISO/IEC 27002 in 2007 to align with the other [ISO/IEC 27000-series](https://bliptext.com/articles/iso-iec-27000-series) standards.\nIt was revised again in 2013 and in 2022.\nLater in 2015 the [ISO/IEC 27017](https://bliptext.com/articles/iso-iec-27017) was created from that standard in order to suggest additional security controls for the cloud which were not completely defined in ISO/IEC 27002.\nISO/IEC 27002 provides [best practice](https://bliptext.com/articles/best-practice) recommendations on information security controls for use by those responsible for initiating, implementing or maintaining [information security management systems](https://bliptext.com/articles/information-security-management-system) (ISMS).\nInformation security is defined within the standard in the context of the [CIA triad](https://bliptext.com/articles/cia-triad):\n\n# Outline\n\n## Outline for ISO/IEC 27002:2022\nThe standard starts with 4 introductory chapters:\n

Scope

Normative Reference

Terms, definitions, and abbreviated terms

Structure of this document

\n\nThese are followed by 4 main chapters:\n

Organizational controls

People controls

Physical controls

Technological controls

\n\n\n## Outline for ISO/IEC 27002:2013\nThe standard starts with 5 introductory chapters:\n

Introduction

Scope

Normative references

Terms and definitions

Structure of this standard

\n\nThese are followed by 14 main chapters:\n

Information Security Policies

Organization of Information Security

Human Resource Security

Asset Management

Access Control

Cryptography

Physical and environmental security

Operation Security- procedures and responsibilities, Protection from malware, Backup, Logging and monitoring, Control of operational software, Technical vulnerability management and Information systems audit coordination

Communication security - Network security management and Information transfer

System acquisition, development and maintenance - Security requirements of information systems, Security in development and support processes and Test data

Supplier relationships - Information security in supplier relationships and Supplier service delivery management

Information security incident management - Management of information security incidents and improvements

Information security aspects of business continuity management - Information security continuity and Redundancies

Compliance - Compliance with legal and contractual requirements and Information security reviews

\n\n\n## Controls\nWithin each chapter, information [security controls](https://bliptext.com/articles/security-controls) and their objectives are specified and outlined.\nThe information security controls are generally regarded as best practice means of achieving those objectives.\nFor each of the controls, implementation guidance is provided.\nSpecific controls are not mandated since:\nMost organizations implement a wide range of information security-related controls, many of which are recommended in general terms by ISO/IEC 27002.\nStructuring the information security controls infrastructure in accordance with ISO/IEC 27002 may be advantageous since it:\n\n# Implementation example of ISO/IEC 27002\nHere are a few examples of typical information security policies and other controls relating to three parts of ISO/IEC 27002.\n(Note: this is merely an illustration. The list of example controls is incomplete and not universally applicable.)\n\n## Physical and Environmental security\n\n## Human Resource security\n\n## Access control\n\n# History\n\n# National equivalent standards\nISO/IEC 27002 has directly equivalent national standards in several countries.\nTranslation and local publication often results in several months' delay after the main ISO/IEC standard is revised and released, but the national standard bodies go to great lengths to ensure that the translated content accurately and completely reflects ISO/IEC 27002.\n\n# Certification\nISO/IEC 27002 is an advisory standard that is meant to be interpreted and applied to all types and sizes of organization according to the particular information security risks they face.\nIn practice, this flexibility gives users a lot of latitude to adopt the information security controls that make sense to them, but makes it unsuitable for the relatively straightforward compliance testing implicit in most formal certification schemes.\n[ISO/IEC 27001:2013](https://bliptext.com/articles/iso-iec-27001-2013) (Information technology – Security techniques – Information security management systems – Requirements) is a widely recognized certifiable standard.\nISO/IEC 27001 specifies a number of firm requirements for establishing, implementing, maintaining and improving an ISMS, and in Annex A there is a suite of information security controls that organizations are encouraged to adopt where appropriate within their ISMS.\nThe controls in Annex A are derived from and aligned with ISO/IEC 27002.\n\n# Ongoing development\nBoth [ISO/IEC 27001](https://bliptext.com/articles/iso-iec-27001) and ISO/IEC 27002 are revised by [ISO/IEC JTC1/SC27](https://bliptext.com/articles/iso-iec-jtc-1-sc-27) every few years in order to keep them current and relevant.\nRevision involves, for instance, incorporating references to other issued security standards (such as [ISO/IEC 27000](https://bliptext.com/articles/iso-iec-27000), [ISO/IEC 27004](https://bliptext.com/articles/iso-iec-27004) and [ISO/IEC 27005](https://bliptext.com/articles/iso-iec-27005)) and various good security practices that have emerged in the field since they were last published.\nDue to the significant 'installed base' of organizations already using ISO/IEC 27002, particularly in relation to the information security controls supporting an ISMS that complies with [ISO/IEC 27001](https://bliptext.com/articles/iso-iec-27001), any changes have to be justified and, wherever possible, evolutionary rather than revolutionary in nature.","current_revision":null,"created_by":"kACnuQmH5k9Nr5VNVEpVeg7XpvUmMctD","created_at":"2025-01-26T09:40:36.928Z","updated_at":"2025-01-26T09:40:36.928Z","search_vector":"'27002':2 'iso/iec':1","search_content":" \n**Title:** ISO/IEC 27002 \n**Domain:** [Information security management](https://bliptext.com/articles/information-security-management) \n**Status:** Published \n**Organization:** [International Organization for Standardization](https://bliptext.com/articles/international-organization-for-standardization) \n**Series:** [ISO/IEC 27000 family](https://bliptext.com/articles/iso-iec-27000-family) \n**Version:** 3 \n**Version Date:** Mar 2022 \n**Committee:** [ISO/IEC JTC 1/SC 27](https://bliptext.com/articles/undefined) \n \n\n# \n**ISO/IEC 27002** is an [information security](https://bliptext.com/articles/information-security) [standard](https://bliptext.com/articles/international-standard) published by the [International Organization for Standardization](https://bliptext.com/articles/international-organization-for-standardization) (ISO) and by the [International Electrotechnical Commission](https://bliptext.com/articles/international-electrotechnical-commission) (IEC), titled Information security, cybersecurity and privacy protection — Information security controls.\nThe [ISO/IEC 27000 family](https://bliptext.com/articles/iso-iec-27000-family) of standards are descended from a corporate security standard donated by [Shell](https://bliptext.com/articles/royal-dutch-shell) to a UK government initiative in the early 1990s.\nThe Shell standard was developed into British Standard BS 7799 in the mid-1990s, and was adopted as ISO/IEC 17799 in 2000.\nThe ISO/IEC standard was revised in 2005, and renumbered ISO/IEC 27002 in 2007 to align with the other [ISO/IEC 27000-series](https://bliptext.com/articles/iso-iec-27000-series) standards.\nIt was revised again in 2013 and in 2022.\nLater in 2015 the [ISO/IEC 27017](https://bliptext.com/articles/iso-iec-27017) was created from that standard in order to suggest additional security controls for the cloud which were not completely defined in ISO/IEC 27002.\nISO/IEC 27002 provides [best practice](https://bliptext.com/articles/best-practice) recommendations on information security controls for use by those responsible for initiating, implementing or maintaining [information security management systems](https://bliptext.com/articles/information-security-management-system) (ISMS).\nInformation security is defined within the standard in the context of the [CIA triad](https://bliptext.com/articles/cia-triad):\n\n# Outline\n\n## Outline for ISO/IEC 27002:2022\nThe standard starts with 4 introductory chapters:\n Scope \n Normative Reference \n Terms, definitions, and abbreviated terms \n Structure of this document \n \nThese are followed by 4 main chapters:\n Organizational controls \n People controls \n Physical controls \n Technological controls \n \n\n## Outline for ISO/IEC 27002:2013\nThe standard starts with 5 introductory chapters:\n Introduction \n Scope \n Normative references \n Terms and definitions \n Structure of this standard \n \nThese are followed by 14 main chapters:\n Information Security Policies \n Organization of Information Security \n Human Resource Security \n Asset Management \n Access Control \n Cryptography \n Physical and environmental security \n Operation Security- procedures and responsibilities, Protection from malware, Backup, Logging and monitoring, Control of operational software, Technical vulnerability management and Information systems audit coordination \n Communication security - Network security management and Information transfer \n System acquisition, development and maintenance - Security requirements of information systems, Security in development and support processes and Test data \n Supplier relationships - Information security in supplier relationships and Supplier service delivery management \n Information security incident management - Management of information security incidents and improvements \n Information security aspects of business continuity management - Information security continuity and Redundancies \n Compliance - Compliance with legal and contractual requirements and Information security reviews \n \n\n## Controls\nWithin each chapter, information [security controls](https://bliptext.com/articles/security-controls) and their objectives are specified and outlined.\nThe information security controls are generally regarded as best practice means of achieving those objectives.\nFor each of the controls, implementation guidance is provided.\nSpecific controls are not mandated since:\nMost organizations implement a wide range of information security-related controls, many of which are recommended in general terms by ISO/IEC 27002.\nStructuring the information security controls infrastructure in accordance with ISO/IEC 27002 may be advantageous since it:\n\n# Implementation example of ISO/IEC 27002\nHere are a few examples of typical information security policies and other controls relating to three parts of ISO/IEC 27002.\n(Note: this is merely an illustration. The list of example controls is incomplete and not universally applicable.)\n\n## Physical and Environmental security\n\n## Human Resource security\n\n## Access control\n\n# History\n\n# National equivalent standards\nISO/IEC 27002 has directly equivalent national standards in several countries.\nTranslation and local publication often results in several months' delay after the main ISO/IEC standard is revised and released, but the national standard bodies go to great lengths to ensure that the translated content accurately and completely reflects ISO/IEC 27002.\n\n# Certification\nISO/IEC 27002 is an advisory standard that is meant to be interpreted and applied to all types and sizes of organization according to the particular information security risks they face.\nIn practice, this flexibility gives users a lot of latitude to adopt the information security controls that make sense to them, but makes it unsuitable for the relatively straightforward compliance testing implicit in most formal certification schemes.\n[ISO/IEC 27001:2013](https://bliptext.com/articles/iso-iec-27001-2013) (Information technology – Security techniques – Information security management systems – Requirements) is a widely recognized certifiable standard.\nISO/IEC 27001 specifies a number of firm requirements for establishing, implementing, maintaining and improving an ISMS, and in Annex A there is a suite of information security controls that organizations are encouraged to adopt where appropriate within their ISMS.\nThe controls in Annex A are derived from and aligned with ISO/IEC 27002.\n\n# Ongoing development\nBoth [ISO/IEC 27001](https://bliptext.com/articles/iso-iec-27001) and ISO/IEC 27002 are revised by [ISO/IEC JTC1/SC27](https://bliptext.com/articles/iso-iec-jtc-1-sc-27) every few years in order to keep them current and relevant.\nRevision involves, for instance, incorporating references to other issued security standards (such as [ISO/IEC 27000](https://bliptext.com/articles/iso-iec-27000), [ISO/IEC 27004](https://bliptext.com/articles/iso-iec-27004) and [ISO/IEC 27005](https://bliptext.com/articles/iso-iec-27005)) and various good security practices that have emerged in the field since they were last published.\nDue to the significant 'installed base' of organizations already using ISO/IEC 27002, particularly in relation to the information security controls supporting an ISMS that complies with [ISO/IEC 27001](https://bliptext.com/articles/iso-iec-27001), any changes have to be justified and, wherever possible, evolutionary rather than revolutionary in nature.","revisionCount":0},"hasMore":false,"nextCursor":null}