Platform
Modules
By sector
By sector
By standard
Blog
News
Events
ISO/IEC 27002
Security and quality teams implementing the Annex A controls behind an ISO 27001 certificate.
ISO 27002 is the implementation guidance for the information-security controls listed in ISO 27001 Annex A. ComplyTrain holds each control as a requirement with the evidence that shows it is operating - which is what an auditor samples.
ISO 27001 tells you that you need an information security management system and lists the controls you may select in Annex A. It does not tell you how to implement any of them. ISO/IEC 27002 is the companion that does: guidance, control by control, on what the control is for, how it is typically implemented and what to consider when you apply it.
The 2022 revision reorganised the controls into four themes - organisational, people, physical and technological - and gave each control a set of attributes you can filter by. That structure is the useful part: it lets you talk about your controls as a coherent set rather than a numbered list inherited from an annex.
You are certified against ISO 27001. ISO 27002 is not a certifiable standard and there is no such thing as an ISO 27002 certificate. What it gives you is the reasoning behind each control, which is what an auditor is testing when they ask why you implemented one the way you did.
The 2022 revision moved the controls from fourteen clauses into four themes. Organisational controls cover policy, roles, supplier relationships and incident management. People controls cover screening, terms of employment, awareness and what happens when someone leaves. Physical controls cover premises, equipment and media. Technological controls cover access, cryptography, logging, secure development and everything most people picture first.
The regrouping matters more than it sounds. A control set organised by theme can be assigned to the people who own that theme, which a numbered list inherited from an annex cannot. It also makes the gaps visible: an organisation with forty technological controls and three people controls has told you something about itself.
Each control also carries attributes - control type, information security properties, cybersecurity concepts, operational capabilities and security domains. They exist so you can view the same set through whichever lens the conversation needs, which is useful when a customer asks a question framed differently from your documentation.
A control is not implemented because a policy mentions it. It is implemented when something happens, someone is accountable for it, and there is a record. ComplyTrain holds all three against the control itself:
The point is the trail. A control, the reason you selected it, the procedure that implements it, the people trained on it, and the evidence it ran. See requirements management and document control for the mechanics.
Tell us how you need to work with ISO/IEC 27002 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
No, and neither is anyone else. ISO 27002 is guidance and carries no certification. You are certified against ISO 27001; ISO 27002 is how you implement the controls that certificate depends on. ComplyTrain is the system you run that work in.
ISO 27001 is the requirements standard - what your management system must do, and the Annex A list of controls you may select from. ISO 27002 is the implementation guidance for those controls. You get certified to the first using the second.
You are already using it, whether or not you have read it. Every Annex A control you have implemented has guidance behind it, and an auditor asking why a control was implemented a particular way is asking a question ISO 27002 answers.
It reorganised the controls into four themes and merged some, so the numbering moved. The substance of most controls did not. What changes is how you present the set, which is worth getting right because it is how your Statement of Applicability reads.
The 2022 revision lists 93, down from 114, because a number of overlapping controls were merged rather than removed. Eleven are new, and they are largely the ones that had become obvious in the intervening years: threat intelligence, cloud services, ICT readiness for continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.
No, and an organisation that claims to has usually not thought about it. You select controls based on your risk assessment and record why each was included or excluded. That reasoning is the Statement of Applicability, and it is what an auditor reads first.
The process
ISO 27002 is guidance rather than a certifiable standard, so there is no audit to pass against it. The work is applying its controls inside the ISMS you already run.
ISO 27001 decides which controls apply to you. That decision is the entry point: ISO 27002 explains what each of those controls is for and what good implementation looks like.
Each control comes with a stated purpose, implementation guidance and attributes you can filter by. The purpose is what an auditor asks about, and it is where most gaps are actually found.
A control is only as good as the policy, procedure or configuration behind it. Record the decision and the reasoning, so the choice survives the person who made it.
Attach the evidence that shows the control operating, review it on a cadence, and record the changes. This is the difference between a control that exists and one you can demonstrate.
A standard usually arrives as a contract condition rather than a project anyone planned for, and often at a company with no quality manager. Software is half the answer. Skylen's consultants are the other half, and because they build on ComplyTrain from day one you keep a live system your team owns rather than a binder and a departed consultant.
A clause-by-clause read of where you stand against the standard your contract cites, turned into a prioritised plan you could act on with us or alone.
What an assessment coversOur consultants build the system with your team - procedures, document control, the records you need to keep and the review cadence - and prepare you for the certification audit.
How an engagement worksWe run and maintain the quality system for you, so a small team can reach and hold a standard without hiring a quality manager.
What full-service meansOne system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.
Learn how to qualify, approve and monitor sub-suppliers, flow down requirements through purchase orders, and keep the records an auditor will ask to see under ISO 9001 clause 8.4 and AQAP.
Learn how to run an ISO 9001 Clause 9.3 management review that turns evidence into decisions, with the right inputs, actionable outputs, and a cadence that fits your risks.