What is ISO 27002?
ISO/IEC 27002 is the international guidance standard that describes, for 93 information security controls, what they involve, why they are needed and how you implement them, as the practical elaboration of Annex A of ISO 27001. The current edition, ISO/IEC 27002:2022, was published on 15 February 2022 under the title Information security, cybersecurity and privacy protection - Information security controls. It is published by the International Organization for Standardization and the IEC (committee JTC 1/SC 27). It is guidance rather than a requirements standard: there is no such thing as ISO 27002 certification. It does help you implement an Information Security Management System (ISMS) in a concrete and demonstrable way, in office IT as well as in OT environments.
🧠 What exactly does ISO 27002 do?
ISO 27001 sets the requirements for a management system and lists 93 controls in Annex A, each in one or two sentences. ISO 27002 describes how you can implement those same controls. For each control the standard provides:
- Purpose - why the control exists and which risk it reduces
- Guidance - practical explanation, often with a list of what a good implementation covers
- Implementation examples - for instance which topics belong in a policy or which events you should log
- Linkage to risks - the purpose and the attributes show which risk and which security property a control addresses, so you can group controls
| Characteristic | ISO 27001 | ISO 27002 |
|---|---|---|
| Nature | Requirements standard (“shall”) | Guidance (“should”) |
| Certifiable | Yes, by an accredited body | No |
| Content | Clauses 4–10 plus Annex A with 93 short controls | 93 controls with purpose, guidance and attributes |
| Use | Establish a management system and have it audited | Design, implement and test controls |
| Audience | Management, auditors and ISMS owners | Security specialists, administrators and designers |
📜 How did ISO 27002 come about?
ISO 27002 is older than ISO 27001. Its origin was a code of practice for information security that Shell contributed to a UK government initiative in the early 1990s.
| Year | Event |
|---|---|
| 1995 | British standard BS 7799, based on the code of practice |
| 2000 | Adopted as ISO/IEC 17799 |
| 2005 | Revised edition of ISO/IEC 17799 |
| 2007 | Renumbered ISO/IEC 27002, in line with the ISO 27000 family |
| 2013 | Second edition: 114 controls in 14 chapters (domains) |
| 15 February 2022 | Third edition: 93 controls in 4 themes, with attributes |
The 2022 edition also led to a rewrite of Annex A of ISO 27001. Since 31 October 2025, certificates against ISO 27001:2013 are no longer valid, so every certified organisation now works with the structure of ISO 27002:2022.
🔢 How is the 2022 edition structured?
The 93 controls sit in clauses 5 to 8, grouped into four themes:
| Clause | Theme | Number | Examples |
|---|---|---|---|
| 5 | Organisational controls | 37 | 5.1 policies, 5.9 inventory of assets, 5.19 supplier relationships, 5.24 incident management |
| 6 | People controls | 8 | 6.1 screening, 6.3 awareness and training, 6.7 remote working |
| 7 | Physical controls | 14 | 7.1 physical security perimeters, 7.4 physical security monitoring |
| 8 | Technological controls | 34 | 8.7 protection against malware, 8.13 backup, 8.22 segregation of networks |
Compared with 2013, 11 controls are new, 24 were created by merging older controls and 58 were revised. The new controls are: 5.7 threat intelligence, 5.23 information security for use of cloud services, 5.30 ICT readiness for business continuity, 7.4 physical security monitoring, 8.9 configuration management, 8.10 information deletion, 8.11 data masking, 8.12 data leakage prevention, 8.16 monitoring activities, 8.23 web filtering and 8.28 secure coding.
Every control follows the same fixed layout: a title, an attribute table, the control itself, the purpose, the guidance and, where relevant, other information. The “A.” prefix belongs to Annex A of ISO 27001; in ISO 27002 itself, backup is simply control 8.13.
🏷️ Which attributes does ISO 27002 use?
New in 2022 are five attributes that let you filter the controls from different angles. Every control has an attribute table; whether you use the attributes is up to you.
| Attribute | Values | Use |
|---|---|---|
| Control type | Preventive, detective, corrective | Check the balance between preventing, detecting and recovering |
| Information security properties | Confidentiality, integrity, availability | In OT, availability usually weighs heaviest |
| Cybersecurity concepts | Identify, Protect, Detect, Respond, Recover | Mapping to the NIST CSF |
| Operational capabilities | 15 values, including asset management, identity and access management, threat and vulnerability management, continuity | Assign controls to teams or processes |
| Security domains | Governance and ecosystem, protection, defence, resilience | Reporting to the board |
You may also add your own attributes, for example “relevant to OT” or a reference to the Purdue level at which a control operates.
🏭 Which ISO 27002 controls matter most for OT?
ISO 27002 is written generically, but many controls apply directly to SCADA, PLCs and the process network. A selection, with the OT interpretation:
| Control | Topic | Interpretation in OT |
|---|---|---|
| 5.9 | Inventory of information and assets | An up-to-date asset inventory of PLCs, HMIs and network components, including firmware versions |
| 5.19–5.22 | Supplier relationships | Requirements for suppliers and system integrators, including remote maintenance |
| 5.24–5.28 | Incident management | An incident response plan that also covers manual operation and safely stopping the process |
| 5.30 | ICT readiness for business continuity | Recovery plans aligned with business continuity and process safety |
| 8.8 | Management of technical vulnerabilities | Vulnerability management with patching during maintenance stops and compensating controls |
| 8.9 | Configuration management | Configuration management of PLC programs and network settings |
| 8.13 | Information backup | A tested backup of PLC code, SCADA projects and historian data |
| 8.15–8.16 | Logging and monitoring | Logging and passive security monitoring of industrial protocols |
| 8.22 | Segregation of networks | Network segmentation between office and process networks |
| 8.32 | Change management | Change management with testing, approval and a fallback scenario |
At the same time, ISO 27002 has clear limits for OT. It has no zones and conduits, no security levels and no technical requirements for components. For those, IEC 62443 is the appropriate series; since its 2024 edition, IEC 62443-2-1 is designed to work alongside an existing ISMS. For process control in the energy sector there is also ISO/IEC 27019, a sector variant of ISO 27002 for the generation, transmission and distribution of energy (nuclear plants excluded), with a 2024 edition.
🔄 How does ISO 27002 relate to other standards?
| Standard or framework | Function | Relationship with ISO 27002 |
|---|---|---|
| ISO 27001 | Requirements for an ISMS | Annex A contains the same 93 controls in condensed form |
| ISO 27005 | Guidance on information security risk management | Provides the risk assessment used to select controls |
| BIO | Dutch government security baseline | BIO2 (adopted 23 September 2025) links the government measures to the 93 controls of ISO 27002:2022 |
| CSIR | Implementation guideline for OT in government and utilities | Translates BIO and IEC 62443 to pumping stations, locks and treatment plants |
| IEC 62443 | Cybersecurity for industrial automation | Adds zones, conduits, security levels and component requirements |
| NIST CSF | US framework (version 2.0, February 2024) | The cybersecurity concepts attribute follows the functions Identify to Recover |
Neither NIS2 nor the Dutch Cybersecurity Act mandates a specific standard. The explanatory notes to the Cybersecurity Decree name ISO 27001 and a management system based on IEC 62443 as starting points; ISO 27002 is then the practical guide for implementing the measures required by the duty of care.
🧭 How do you use ISO 27002 in practice?
- Start with the risks - carry out a risk assessment, for example following ISO 27005, and select controls based on the outcome, not on the list.
- Record your choices - the Statement of Applicability (SoA) from ISO 27001 states for each control whether it applies and why. Exclusion is allowed if justified.
- Use the guidance as a design checklist - compare existing practice with the guidance for each control and log the gaps as improvement actions.
- Translate to OT - where a control cannot be applied literally in OT, such as rapid patching or an agent on a PLC, describe a compensating control.
- Assign ownership - the CISO is ultimately accountable; an Information Security Officer coordinates implementation together with the OT manager.
- Review and improve - internal audits and the PDCA cycle keep the controls up to date.
A hypothetical but typical example: a food manufacturer with ISO 27001 certification discovers that the backup of its PLC programs falls outside the IT department’s scope. Control 8.13 recommends testing backups regularly; after a restore test, the OT team becomes owner of its own backup procedure, recorded in the SoA.
❓ Frequently asked questions
Can you get certified for ISO 27002?
No, ISO 27002 is a guidance document rather than a requirements standard, so certification against it is not possible. Organisations get certified against ISO 27001 and use ISO 27002 to implement the 93 controls from Annex A properly. Auditors do often use ISO 27002 as a reference during an assessment.
How many controls does ISO 27002:2022 contain?
ISO 27002:2022 contains 93 controls: 37 organisational, 8 people, 14 physical and 34 technological. The 2013 edition had 114, spread across 14 chapters. Eleven controls were newly added in 2022.
Why do old control numbers no longer match?
The numbering of ISO 27002 changed completely in 2022 because the 14 chapters were replaced by 4 themes. Management of technical vulnerabilities, for example, was control 12.6.1 and is now 8.8, and backup was 12.3.1 and is now 8.13. Annex A of ISO 27001 uses the same numbers with an “A.” prefix, such as A.8.8. ISO 27002:2022 includes an annex with a correspondence table between both editions.
Is ISO 27002 suitable for OT environments?
ISO 27002 is useful for the organisational foundation of OT security, such as asset inventory, supplier management, backup and change management. However, it has no zones, conduits or security levels and sets no requirements for PLCs or SCADA systems. That is why most industrial organisations combine ISO 27002 with IEC 62443.
Is ISO 27002 mandatory under NIS2 or the Dutch Cybersecurity Act?
ISO 27002 is not mandatory under NIS2 or the Dutch Cybersecurity Act, as the law does not prescribe a specific standard. The explanatory notes to the Cybersecurity Decree do name ISO 27001 as a starting point, and ISO 27002 helps work out the required measures in concrete terms. For Dutch government organisations, the BIO, which is based on ISO 27002, is mandatory.
What are attributes in ISO 27002?
Attributes are labels that ISO 27002:2022 attaches to every control, such as control type, security property and cybersecurity concept. There are five standard attributes, and you may add your own. This lets you filter controls quickly, for example everything that is detective or everything that protects availability.
📌 In summary
ISO 27002 is the practical companion to ISO 27001: for 93 controls in four themes it describes the purpose, guidance and attributes, so you can implement what Annex A asks for in a risk-based and demonstrable way. In IT and OT, the standard forms the organisational foundation of information security. For the technical security of process control, you complement ISO 27002 with IEC 62443.