ISO 27002 is a supporting document that provides guidance on 93 best practice information security controls that can be implemented to help mitigate the risks identified by your ISO 27001 risk assessment. The ISO/IEC 27002:20022 Standard restructured and rationalised the previous 114 controls, and added a further 11 controls to the structure, reflecting the evolving IS technologies and the emergence of new threats.
In fact, these 93 controls are replicated in Annex A of ISO 27001 and you are required to consider all of them when determining the most appropriate actions to mitigate your risks.
The controls are separated into 4 main themes organisational, people, technological and physical. The Standard also introduced 5 ‘attributes’, where you can assign hashtags to controls to enable you to filter, sort, or present controls in different ways. More information can be found here.
Book FREE Consultation
URM is pleased to provide a FREE consultation on Transitioning to ISO 27001:2022 for any UK-based organisation.
Find out more
related BLog
ISO 27001:2022 - A.5 Organisational Controls (Access Management)
Published on
18 Dec
2025
URM’s blog explores why the access controls in ISO 27001 matter, and how to implement each control in full conformance with both the Standard and best practice.
Read more
Information Security
Published on
16/12/2025
ISO 27001 Control 8.17: Why Clock Synchronisation Is Critical for Security and ConformanceRead URM’s blog, where we explore the importance of clock synchronisation for cyber security and resilience, and how to meet the requirements of Control 8.17.
Read more
Information Security
Published on
8/9/2025
ISO 27001 Clause 5.1: Leadership and Commitment ExplainedURM’s blog explores Clause 5.1 of ISO 27001, what you must do to meet its requirements, and why leadership & commitment are vital to an effective ISMS.
Read more
Cyber Security
Published on
29/8/2025
Critical Cyber Security Practices to Defend Against Ransomware AttacksURM’s blog examines how ransomware occur, and highlights practical cyber security measures you can implement to reduce your exposure and mitigate security risk.
Read more
"
I found the course very informative, and the trainer was communicative, supportive and engaging. He is very skilled at adapting to the different types of people and transferring knowledge in a way that sticks with attendees; he delivered the same training over 2 years ago and I still remember the things he taught us. We will definitely be recommending him to other businesses that want to learn about ISO standards. Definitely a great asset to the company.
contact US
Let us help you
Let us help you in your compliance journey by completing the form and letting us know how we can best support you.