ISO 27002: Information Security Controls Guide

ISO 27002 (formally ISO/IEC 27002:2022) is an international standard providing a reference catalog of generic information security controls and implementation guidance. As described on the official page on November 9, 2026, it serves as an authoritative code of practice helping organizations establish security controls tailored to operational risk. In research administration, laboratory compliance, and academic computing, ISO 27002 supplies the technical and organizational blueprints required to protect scientific data and ensure institutional system integrity.

What it is and who runs it

ISO/IEC 27002:2022 is titled Information security, cybersecurity and privacy protection — Information security controls. It is jointly developed and administered by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) via committee ISO/IEC JTC 1/SC 27 under classification ICS 35.030.

The third edition was published on February 15, 2022, spanning 152 pages, superseding the 2013 edition. While ISO/IEC 27001 defines mandatory requirements for an Information Security Management System (ISMS) against which organizations are certified, ISO/IEC 27002 serves as the implementation guidance manual. It provides detailed advice for operationalizing control objectives in ISO 27001 Annex A. Organizations deploying an ISO 27001 research data security framework rely on ISO 27002 to execute controls across research computing environments.

Eligibility

As described on the official page on November 9, 2026, ISO/IEC 27002 has no restrictive eligibility criteria. Because it is a voluntary code of practice rather than an accreditation scheme or statutory regulation, any organization may adopt its recommendations regardless of size or sector.

Adoption is prevalent across:

Academic Research Facilities: Higher education institutions safeguarding compute clusters and shared scientific repositories.
Biomedical and Clinical Laboratories: Facilities adhering to GxP regulatory compliance requirements and Good Laboratory Practice benchmarks.
Academic Medical Centers: Research environments managing protected health information (PHI) alongside clinical trial records.
Research Software Vendors: Providers delivering electronic lab notebooks (ELNs) or laboratory information management systems (LIMS).

What it funds or requires

ISO/IEC 27002 provides no grant funding; rather, it details a structured catalog of 93 security controls grouped into four themes (clauses), consolidating the 114 controls from the 2013 edition.

The Four Control Themes

Clause 5: Organizational Controls (37 controls): Policies, roles, threat intelligence, identity management, and supplier governance.
Clause 6: People Controls (8 controls): Screening, employment terms, security training, disciplinary actions, and remote work.
Clause 7: Physical Controls (14 controls): Physical security perimeters, entry barriers, clear desk rules, and equipment maintenance essential for physical laboratory security.
Clause 8: Technological Controls (34 controls): Access rights, endpoint defense, configuration management, patching, and logging. These controls safeguard institutional data integrity standards and reinforce ALCOA+ data integrity principles across digital research records.

The 11 New Controls in the 2022 Edition

The 2022 revision added 11 modern controls:

Threat intelligence (5.7): Analyzing threat data to direct defensive measures.
Information security for use of cloud services (5.23): Security processes for acquiring and managing cloud services.
ICT readiness for business continuity (5.30): Ensuring technology resilience during operational disruptions.
Physical security monitoring (7.4): Continuous surveillance of facilities and server spaces.
Configuration management (8.9): Enforcing baseline security configurations across systems.
Information deletion (8.10): Secure data erasure adhering to retention schedules.
Data masking (8.11): Applying pseudonymization and masking to sensitive datasets.
Data leakage prevention (8.12): Detecting and preventing unauthorized data exfiltration.
Monitoring activities (8.16): Behavioral tracking of network and system events.
Web filtering (8.28): Restricting access to malicious external web resources.
Secure coding (8.32): Embedding secure development standards into software authoring.

The Five Control Attributes

Each control is tagged across five standardized attributes, facilitating integration with frameworks like the NIST Cybersecurity Framework 2.0:

Control Type: Preventive, Detective, or Corrective.
Information Security Properties: Confidentiality, Integrity, and Availability.
Cybersecurity Concepts: Identify, Protect, Detect, Respond, and Recover.
Operational Capabilities: 15 functional domains including Governance, Asset management, and Application security.
Security Domains: Governance and ecosystem, Protection, Defense, and Resilience.

Application or compliance steps

Implementing ISO 27002 guidance follows five structured steps tailored to organizational risk profile:

Step 1: Scoping and Boundary Definition

Identify systems, research datasets, and physical facilities, accounting for institutional policies, grant terms, and mandates like HIPAA or FDA 21 CFR Part 11.

Step 2: Risk Assessment

Perform an information security risk assessment across instrumentation networks, compute nodes, and repositories to determine threat impacts and vulnerabilities.

Step 3: Statement of Applicability (SoA) Formulation

Evaluate all 93 controls in ISO 27002 against identified risks. Document the justification for every selected control and state reasons for omitting inapplicable controls.

Step 4: Control Implementation and Operationalization

Deploy chosen controls via Standard Operating Procedures (SOPs), technical parameters (e.g., multi-factor authentication, log ingestion), and staff training.

Step 5: Monitoring, Measurement, and Internal Audit

Track control effectiveness using operational metrics. Periodically review logs and conduct internal audits to verify compliance and adapt controls.

Typical timeline phases

Implementing ISO 27002 guidance typically spans 9 to 12 months across five operational phases:

Phase 1: Project Initiation and Gap Analysis (Months 1–3): Secure sponsorship, map current practices against the 93 controls, and identify missing safeguards.
Phase 2: Risk Assessment and SoA Development (Months 3–5): Execute threat evaluations, prioritize vulnerabilities, select controls, and draft the Statement of Applicability.
Phase 3: Policy Drafting and Technical Deployment (Months 5–9): Author institutional SOPs, deploy technical configurations, and execute staff training.
Phase 4: Operational Testing and Internal Audit (Months 9–12): Collect compliance evidence, test technical controls, execute an internal audit, and resolve non-conformities.
Phase 5: Continual Improvement and Surveillance (Ongoing): Conduct annual risk reviews, evaluate vendor security, update threat feeds, and adapt controls.

Common mistakes

Institutions implementing ISO/IEC 27002 frequently make several critical mistakes:

Pursuing ISO 27002 Certification: ISO 27002 is an advisory code of practice, not an auditable certification standard. Accredited certification is issued exclusively against ISO/IEC 27001. Stating an organization holds an “ISO 27002 certificate” misrepresents standards governance.
Treating the Catalog as a Universal Checklist: Attempting to implement every control without risk assessment wastes resources. Controls must be selected and tailored based on institutional threat models.
Over-Focusing on Technology: Focusing solely on technical safeguards while ignoring Clause 5 (Organizational) and Clause 6 (People) controls leaves organizations vulnerable to phishing, insider error, and third-party risks.
Failing to Migrate from Legacy 2013 Mappings: Retaining older 2013 Annex A mappings ignores the 11 new controls and prevents organizations from leveraging the 2022 attribute taxonomy.
Overlooking Supplier Governance: Neglecting controls 5.19 through 5.23 when contracting cloud hosts, sequencing services, or SaaS LIMS vendors introduces unvetted third-party security risks.

Related programs

The table below summarizes how ISO/IEC 27002 compares with related standards and compliance frameworks:

Standard / Framework	Governing Body	Primary Scope	Certifiable?	Relationship to ISO 27002
ISO/IEC 27001:2022	ISO / IEC JTC 1/SC 27	ISMS requirements and Annex A objectives	Yes (Accredited Certification)	ISO 27001 sets formal requirements; ISO 27002 provides implementation guidance for Annex A.
NIST SP 800-53 Rev. 5	NIST (US Dept of Commerce)	Federal security and privacy controls catalog	No (Federal Assessment / FISMA)	Harmonized via NIST CSRC OLIR; provides granular technical control specifications.
NIST Cybersecurity Framework (CSF 2.0)	NIST	Risk-based cybersecurity management	No (Voluntary Guidance)	Directly harmonized with ISO 27002:2022 cybersecurity concept attributes (Identify, Protect, Detect, Respond, Recover).
CIS Critical Security Controls v8	Center for Internet Security (CIS)	Prioritized cyber defense safeguards (18 controls)	No (Audit Benchmarks)	Provides prescriptive tactical benchmarks that operationalize ISO 27002 Clause 8 technological controls.
SOC 2 (Type I / Type II)	AICPA	Trust Services Criteria for service providers	Yes (Attestation Report)	ISO 27002 control implementations frequently provide audit evidence supporting SOC 2 criteria.
FDA 21 CFR Part 11 / EU Annex 11	US FDA / European Commission	Electronic records, signatures, and system validation	No (Regulatory Inspection)	ISO 27002 access control and audit logging controls satisfy electronic records integrity mandates in GxP labs.

FAQ

Can an organization achieve certification against ISO 27002?

No. ISO/IEC 27002 is an advisory code of practice, not a certifiable management system standard. Organizations seeking accredited certification must be audited against ISO/IEC 27001. ISO 27002 serves as the implementation reference for controls outlined in ISO 27001 Annex A.

What is the primary difference between ISO 27001 and ISO 27002?

ISO 27001 establishes the mandatory governance requirements for an Information Security Management System (ISMS), specifying what must be done. ISO 27002 provides the comprehensive reference catalog detailing how to design, configure, and implement each security control.

How many controls are contained in ISO/IEC 27002:2022?

ISO/IEC 27002:2022 contains 93 controls structured into four themes: Organizational (37 controls), People (8 controls), Physical (14 controls), and Technological (34 controls). This streamlined structure replaces the 114 controls across 14 clauses found in the 2013 edition.

Are all 93 controls mandatory for an organization implementing an ISMS?

No. Implementation is strictly risk-based. An organization conducts an information security risk assessment to identify relevant threats, selects applicable controls to mitigate those risks, and justifies exclusions within a formal Statement of Applicability (SoA).

How does ISO 27002:2022 map to NIST SP 800-53 and the NIST CSF?

NIST publishes official crosswalks through its Computer Security Resource Center (CSRC) Online Informative References (OLIR) program, mapping SP 800-53 Rev. 5 controls to ISO 27002. Additionally, ISO 27002:2022 embeds NIST CSF core functions as standardized cybersecurity concept attributes for every control.

Sources

International Electrotechnical Commission & International Organization for Standardization. (2022). ISO/IEC 27002:2022: Information security, cybersecurity and privacy protection — Information security controls (Edition 3.0, 152 pages). IEC Webstore. https://webstore.iec.ch/en/publication/74287 (Accessed November 9, 2026).
National Institute of Standards and Technology. (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53, Revision 5). NIST Computer Security Resource Center. https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final (Accessed November 9, 2026).
European Union Agency for Cybersecurity. (2023). Good Practices for Supply Chain Cybersecurity. ENISA Publications. https://www.enisa.europa.eu/publications/good-practices-for-supply-chain-cybersecurity (Accessed November 9, 2026).