ISO 27002

ISO 27002

Information technology - security techniques - code of practice for information security controls

Information technology - security techniques - code of practice for information security controls
Red Overlay
ISO 27002 Information technology - security techniques - code of practice for information security controls
ISO 27002 Information technology - security techniques - code of practice for information security controls
Red Overlay

What is ISO/IEC 27002?

ISO/IEC 27002 on its second edition published as ISO/IEC 27002:2013 Information Technology. Security Techniques. Code of practice for information security controls – is a guidance document used as reference for selecting, implementing, and managing controls for both, organizations with an information security management systems (ISMS) based on ISO/IEC 27001, it provides details on the Annex A listed controls; and for any organization with information security best practices in place, wishing to implement commonly accepted information security controls.

What you need to know about ISO/IEC 27002

The standard ISO/IEC 27002:2013 information technology - security techniques - code of practice for information security controls has been revised and is expected to be published in February this year under the ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection - information security controls edition.

All organizations with an ISMS or information security good practices will have to map and update their controls in place against the new guidance on the updated ISO/IEC 27002, according to the organisational needs and context.

What’s new about ISO/IEC 27002:2022?

ISO/IEC 27002:2022 is a revision of BS EN ISO/IEC 27002:2017. The key changes in ISO/IEC 27002:2022 are:

  • The phrase “code of practice” has been omitted to reflect better its purpose of being a reference set of information security controls
  • The number of security control listed has decreased from 114 to 93, with some controls being removed as they no longer reflect best practices.
  • Eleven new controls have been introduced in the latest version. These reflect the evolvement in technologies and industrial practices including threat intelligence, information security for use of cloud services, and data leakage prevention.
  • The 2022 edition provides references to the 2013 edition control identifiers to better facilitate companies’ transition to the latest edition

Why use ISO/IEC 27002:2022?

It provides a reference set of generic information security controls and guidance on their implementation. It’s a supplementary guide to ISO/IEC 27001 that helps users to identify and implement the information security controls that are most appropriate to their organization’s needs and which in turn can help strengthen the way in which information is protected.

How can ISO/IEC 27002 help your business?

  • Identify suitable and proportionate security controls within the process of setting up an information security management system (ISMS)
  • Achieve best practice in information security management
  • Meet legal, statutory, regulatory and contractual requirements in relation to information security
  • Strengthen risk management and reduce the likelihood of information security breaches
  • Increase confidence in the organization’s ISMS
  • Increase the overall robustness and resilience of ISMS and strengthen risk management
  • Contribute to UN Sustainable Development Goal 9 on industry, innovation and infrastructure

Why BSI

BSI has been at the forefront of ISO 27001 since it was developed and it was originally based on BS 7799, the first information security management system standard developed by BSI in 1995. From then, BSI has been involved in the development and updating process for the entire ISO 27000 family of standards.

BSI is committed to a secure digital world and helps build information resilience in organizations worldwide.