ISO 27002 is a supporting document that provides guidance on 93 best practice information security controls that can be implemented to help mitigate the risks identified by your ISO 27001 risk assessment. The ISO/IEC 27002:20022 Standard restructured and rationalised the previous 114 controls, and added a further 11 controls to the structure, reflecting the evolving IS technologies and the emergence of new threats.
In fact, these 93 controls are replicated in Annex A of ISO 27001 and you are required to consider all of them when determining the most appropriate actions to mitigate your risks.
The controls are separated into 4 main themes organisational, people, technological and physical. The Standard also introduced 5 ‘attributes’, where you can assign hashtags to controls to enable you to filter, sort, or present controls in different ways. More information can be found here.
Book FREE Consultation
URM is pleased to provide a FREE consultation on Transitioning to ISO 27001:2022 for any UK-based organisation.
Find out more
related BLog
Information Risk Assessment and Treatment in ISO 27001
Published on
5 Jun
2025
URM’s blog explains how to conduct information security risk assessments and implement risk treatments that are both efficient and ISO 27001 conformant.
Read more
Information Security
Published on
29/5/2025
Implementing Technological Controls in ISO 27001URM’s blog offers key guidance on how to effectively implement technological controls in your organisation, the common challenges & how these can be overcome.
Read more
Information Security
Published on
23/5/2025
ISO 27001:2022 - A.5 Organisational Controls (Legal, Regulatory and Contractual)URM’s blog explains the legal, regulatory & contractual controls in ISO 27001 & how they can be implemented in full conformance with the Standard.
Read more
Information Security
Published on
19/5/2025
ISO 27001:2022 - A.5 Organisational Controls (Information Security Management)URM explains the 8 information security management controls included within the ‘Organisational controls’ theme and how to prepare for an audit of each control
Read more
"
Our URM consultant was really thorough, genuinely helpful and contributed real value literally within the first few minutes of our session by pointing out some (not-so-obvious) details of the new version of ISO 27001 that we hadn't been aware of until then. He then proceeded with a very well-prepared run-through and explanation of the controls in scope for our upcoming internal audit. Definitely a highlight and overall, very positive experience for us!
contact US
Let us help you
Let us help you in your compliance journey by completing the form and letting us know how we can best support you.