ISO 27002 is a supporting document that provides guidance on 93 best practice information security controls that can be implemented to help mitigate the risks identified by your ISO 27001 risk assessment. The ISO/IEC 27002:20022 Standard restructured and rationalised the previous 114 controls, and added a further 11 controls to the structure, reflecting the evolving IS technologies and the emergence of new threats.
In fact, these 93 controls are replicated in Annex A of ISO 27001 and you are required to consider all of them when determining the most appropriate actions to mitigate your risks.
The controls are separated into 4 main themes organisational, people, technological and physical. The Standard also introduced 5 ‘attributes’, where you can assign hashtags to controls to enable you to filter, sort, or present controls in different ways. More information can be found here.
Without doubt, URM helped us to achieve our planned objectives a lot sooner than expected. The engagement was a huge success and couldn’t have gone any better.
Postal service company
Thinking about ISO 27001 but unsure how your project should take shape?
We offer a free, no‑commitment call to help you clarify your certification pathway, understand the standard in the context of your business.
Find out more
related BLog
Implementing Technological Controls in ISO 27001
Published on
17 Sep
2026
URM’s blog offers key guidance on how to effectively implement technological controls in your organisation, the common challenges & how these can be overcome.
Read more
Information Security
Published on
17/9/2026
ISO 27001:2022 - A.5 Organisational Controls (Supplier Management)URM’s blog explains the importance of the 5 supplier management controls in ISO 27001 & provides practical guidance on how to implement each control.
Read more
Information Security
Published on
17/9/2026
ISO 27001:2022 - A.5 Organisational Controls (Access Management)URM’s blog explores why the access controls in ISO 27001 matter, and how to implement each control in full conformance with both the Standard and best practice.
Read more
Information Security
Published on
17/9/2026
ISO 27001:2022 - A.5 Organisational Controls (Legal, Regulatory and Contractual)URM’s blog explains the legal, regulatory & contractual controls in ISO 27001 & how they can be implemented in full conformance with the Standard.
Read more
"
Without URM we would not have achieved our certification goals.
Director, Havas People
contact US
Let us help you
Let us help you in your compliance journey by completing the form and letting us know how we can best support you.