ISO 27002 is a supporting document that provides guidance on 93 best practice information security controls that can be implemented to help mitigate the risks identified by your ISO 27001 risk assessment. The ISO/IEC 27002:20022 Standard restructured and rationalised the previous 114 controls, and added a further 11 controls to the structure, reflecting the evolving IS technologies and the emergence of new threats.
In fact, these 93 controls are replicated in Annex A of ISO 27001 and you are required to consider all of them when determining the most appropriate actions to mitigate your risks.
The controls are separated into 4 main themes organisational, people, technological and physical. The Standard also introduced 5 ‘attributes’, where you can assign hashtags to controls to enable you to filter, sort, or present controls in different ways. More information can be found here.
Thinking about ISO 27001 but unsure how your project should take shape?
We offer a free, no‑commitment call to help you clarify your certification pathway, understand the standard in the context of your business.
Find out more
related BLog
How do You Identify and Then Manage Your ISMS Scope?
Published on
28 Aug
2026
When managing the security of your organisation’s information assets, you will need to consider the scope of what you are doing.
Read more
Information Security
Published on
14/8/2026
ISO 27001 Clause 9.1: Monitoring, Measurement, Analysis and Evaluation ExplainedURM’s blog explores ISO 27001 Clause 9.1, what it requires and practical guidance on how to implement this Clause in full conformance with the Standard.
Read more
Information Security
Published on
7/8/2026
5 Must-Dos of Effective ISO 27001 Risk ManagementURM’s blog explores five key actions organisations can take to strengthen their ISO 27001 information risk management processes.
Read more
Information Security
Published on
7/8/2026
The Fundamentals of Risk Management in ISO 27001URM’s blog explains the risk management requirements in ISO 27001, including identifying ISMS risk, risk assessment and treatment, documentation and more
Read more
"
It’s one thing having the required technical knowledge, it’s another thing for a consultant to apply that knowledge to the context of our organisation. To use a sporting analogy, we view cyber and information security as a marathon not a sprint. I am not a believer in doing everything all at once. Our approach has been risk based and incremental, remediating our biggest risks first before moving on. I believe this approach is far more sustainable and effective. And URM’s consultants fully understand this and are very pragmatic and tailored in their guidance and advice. They know we are not implementing ISO 27001 purely for the certificate, but more as a framework for continual improvement, and at a pace where new systems and processes can be fully understood and absorbed by our team and be business as usual.
The Owners and Distributors of Quality Brands
contact US
Let us help you
Let us help you in your compliance journey by completing the form and letting us know how we can best support you.