ISO/IEC 27002 Foundation cheat sheet

Information security preserves confidentiality, integrity and availability (CIA); ISO/IEC 27000 defines these three properties as the core of information security.

Confidentiality means information is not disclosed to unauthorized persons, processes or entities; integrity means it is accurate and complete; availability means it is accessible and usable on demand.

Non-repudiation, accountability, authenticity and reliability are supporting properties used in ISO/IEC 27000 alongside CIA, not replacements for it.

ISO/IEC 27002:2022 is a guidance standard of controls; it does not define a certifiable management system. ISO/IEC 27001 holds the certifiable requirements for an ISMS.

ISO/IEC 27002:2022 structures 93 controls into four themes: organizational (37), people (8), physical (14) and technological (34).

Each 27002:2022 control carries attributes: control type (preventive, detective, corrective), information security properties (C/I/A), cybersecurity concepts (identify, protect, detect, respond, recover), operational capabilities and security domains (governance, protection, defence, resilience).

Risk is the effect of uncertainty on objectives; information security risk combines likelihood of a threat exploiting a vulnerability with the resulting impact on CIA.

Privacy relates to protection of personally identifiable information (PII); ISO/IEC 27701 extends 27001 and 27002 to privacy information management, and ISO/IEC 29100 defines privacy principles and a privacy framework.

Clause 5 organizational controls include policies for information security (5.1), threat intelligence (5.7) and information security in supplier relationships (5.19-5.22).

Segregation of duties (5.3) separates conflicting tasks; access control (5.15) applies need-to-know and least privilege, supported by identity management (5.16) and authentication information (5.17).

Clause 6 people controls cover screening (6.1), terms of employment (6.2), awareness and training (6.3), disciplinary process (6.4) and remote working (6.7).

Clause 7 physical controls include physical security perimeters (7.1), entry controls (7.2), protection against physical and environmental threats (7.5) and secure disposal or reuse of equipment (7.14).

Clause 8 technological controls include malware protection (8.7), management of technical vulnerabilities (8.8), backup (8.13), logging (8.15) and monitoring activities (8.16).

Cryptographic controls (8.24) require a policy on the use of cryptography and key management; data masking (8.11) and data leakage prevention (8.12) address sensitive data exposure.

Control 5.7 threat intelligence requires collecting and analysing information about threats and sharing it with relevant parties; control 5.23 covers information security for use of cloud services.

Incident management is organized around 5.24 planning, 5.25 assessment and decision, 5.26 response, 5.27 learning from incidents and 5.28 collection of evidence.

Business continuity controls (5.29 information security during disruption, 5.30 ICT readiness for business continuity) require plans to be tested and evaluated.