Information security controls based on ISO/IEC 27002
This domain tests how ISO/IEC 27002 organizes, selects, and describes information security controls. Expect the 2022 control themes, control attributes, and the link to risk treatment and the Statement of Applicability.
Control structure
ISO/IEC 27002:2022 provides guidance on 93 controls in four themes: Organizational (37), People (8), Physical (14), and Technological (34). It is guidance, not a certifiable management system standard; ISO/IEC 27001 contains the requirements and Annex A.
Themes and examples
- Organizational: policies, roles and responsibilities, supplier security, incident management, business continuity.
- People: screening, terms of employment, awareness and training, disciplinary process.
- Physical: secure areas, entry controls, equipment protection.
- Technological: access control, malware protection, logging, cryptography, backup.
Control attributes
Controls carry attributes such as control type (preventive, detective, corrective), information security properties (confidentiality, integrity, availability), cybersecurity concepts, operational capabilities, and security domains. Attributes help filter and compare controls.
Worked example
A remote worker accesses customer PII. Risk: unauthorized access or data loss. Select controls across themes: an organizational remote-working policy and cloud supplier terms; people awareness training and acceptable-use rules; physical locked storage at home; technological MFA, VPN, disk encryption, and logging. Reasoning: no single control covers the risk; each control maps to a theme and is justified in the Statement of Applicability.
Traps
- Treating ISO/IEC 27002 as certifiable; it is implementation guidance.
- Using the 2013 figures (114 controls, 35 objectives) instead of the 2022 structure.
- Answering only with technological controls and forgetting people and physical controls.
- Listing Annex A controls without risk-based justification or applicability decisions.