ISO 27002 Lead Manager cheat sheet

Confidentiality, integrity and availability (CIA) are the three core information security properties; ISO/IEC 27000 defines each and they anchor every control objective in ISO/IEC 27002:2022.

Information security preserves CIA; cybersecurity adds the protection of networks, systems and data against digital attack, including resilience and the ability to recover.

Privacy protection concerns the rights of natural persons (PII principals) and is governed by principles such as lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, and accountability.

ISO/IEC 27701 extends ISO/IEC 27001 and 27002 to PII controllers and processors; privacy controls are additive to, not a substitute for, information security controls.

Risk is defined as the effect of uncertainty on objectives, expressed as a combination of likelihood of an event and its consequence; ISO/IEC 27005 provides the risk management guidance.

The 2022 edition of ISO/IEC 27002 restructured controls into four themes: organizational (37), people (8), physical (14) and technological (34), totalling 93 controls.

Five control attributes are used for classification: control type (preventive, detective, corrective), information security properties (CIA), cybersecurity concepts (identify, protect, detect, respond, recover), operational capabilities, and security domains (governance, protection, defence, resilience).

Defence in depth layers preventive, detective and corrective controls; no single control is assumed sufficient, and compensating controls address residual risk where a primary control is not feasible.

Threat, vulnerability, likelihood and impact are distinct: a threat exploits a vulnerability, likelihood estimates occurrence, and impact measures consequence on CIA or on PII principals.

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an ISMS; ISO/IEC 27002 is guidance and is not certifiable on its own.

Plan-Do-Check-Act (PDCA) underpins continual improvement; ISO/IEC 27001:2022 clauses 4-10 map to context, leadership, planning, support, operation, performance evaluation and improvement.

Clause 6.1 requires risk assessment and risk treatment, and 6.1.3 requires a Statement of Applicability (SoA) listing each Annex A control, its applicability, justification, and implementation status.

Annex A of ISO/IEC 27001:2022 mirrors the 93 controls and 4 themes of ISO/IEC 27002:2022; the SoA must reference all 93 controls even where exclusion is justified.

Scope definition (clause 4.3) must consider internal and external issues, interested parties, interfaces and dependencies; scope exclusions require justification in the SoA.

Risk treatment options per ISO/IEC 27005 are: modify (mitigate), retain (accept), avoid, and share (transfer); selected options drive control selection from ISO/IEC 27002.

Gap analysis compares current controls against the ISO/IEC 27002:2022 control set to produce a remediation roadmap prioritised by risk, cost and dependency.

Documented information required includes the ISMS scope, information security policy, risk assessment and treatment results, SoA, and evidence of competence and monitoring.

Top management must demonstrate leadership through policy approval, resource provision, assignment of roles, and integration of information security into business processes (clause 5).

Organizational controls (5.1-5.37) include policies, roles and responsibilities, segregation of duties, threat intelligence, information classification, access control policy, supplier relationships, incident management, business continuity and legal compliance.

Information classification (5.12) and labelling (5.13) require a scheme defining levels, handling rules, and a defined owner who approves classification and access decisions.

Access control (5.15-5.18) follows need-to-know and least privilege; access rights are granted through a formal request, reviewed at defined intervals, and removed on termination.

Supplier relationships (5.19-5.22) require due diligence before contracting, security requirements in agreements, monitoring of service delivery, and management of changes to supplier services.

Information security incident management (5.24-5.28) covers planning, reporting channels, assessment and decision, response, and learning from incidents; evidence collection must preserve chain of custody.

Business continuity (5.29, 5.30) requires ICT readiness planning based on business impact analysis, with recovery objectives (RTO, RPO) defined and tested.

Legal, statutory and contractual requirements (5.31-5.34) include identification of applicable legislation, protection of intellectual property, records retention, and privacy and PII protection.

People controls (6.1-6.8) cover screening, terms and conditions of employment, awareness and training, disciplinary process, post-termination responsibilities, confidentiality agreements and remote working.

Screening (6.1) must comply with law and ethics and be proportionate to the role's sensitivity and the classification of information the person will access; background verification is repeated where justified.

Physical controls (7.1-7.14) include perimeter protection, physical entry controls, securing offices and facilities, monitoring, protection against physical and environmental threats, and secure disposal or reuse of equipment.

Clear desk and clear screen (7.7) and secure disposal (7.14) require defined rules for unattended media and verified destruction or sanitisation before equipment leaves the organisation.

Technological controls (8.1-8.34) include endpoint protection, privileged access rights, information access restriction, cryptography, logging, backup, data leakage prevention, and secure development.

Privileged access rights (8.2) require restriction and management of administrative accounts, separate accounts for administrative tasks, and logging of privileged activity.

Cryptography (8.24) requires a policy defining when and how cryptographic controls are used, including key management lifecycle: generation, distribution, storage, rotation, revocation and destruction.

Logging (8.15, 8.16) requires event logs recording activities, exceptions and faults, with clocks synchronised and monitoring activities defined for anomaly detection.

Backup (8.13) requires backup copies of information, software and systems, tested at defined intervals and protected in accordance with the classification of the source data.

Secure development (8.25-8.31) covers secure coding principles, security requirements analysis, separation of development, test and production environments, and protection of test information.

Technical vulnerability management (8.8) requires timely identification of vulnerabilities, risk-based evaluation, patching, and management of the exposure window; it is distinct from penetration testing.

Clause 9.1 requires monitoring, measurement, analysis and evaluation with defined: what is monitored, methods, when, who, and when results are analysed and evaluated.

Clause 9.2 requires internal audit at planned intervals, with an audit programme considering the importance of processes and prior results; auditors must be independent of the audited activity.

Clause 9.3 requires management review at planned intervals covering audit results, nonconformities, monitoring results, risk assessment status, and opportunities for improvement.

Key performance indicators measure control effectiveness (e.g., percentage of access reviews completed on time); key risk indicators measure exposure trends; both need baselines and targets.

Control testing methods include walkthrough, observation, inspection of evidence, re-performance, sampling, and technical testing such as vulnerability scanning and penetration testing.

Evidence must be sufficient, reliable and time-bound; sampling size should reflect population size and risk, and exceptions must be recorded with root cause analysis.

Nonconformity and corrective action (clause 10.2) require identifying the cause, evaluating the need for action, implementing it, reviewing effectiveness, and retaining documented information.

Penetration testing should follow a defined scope and rules of engagement, be performed by competent testers, and results fed into the risk treatment process rather than treated as an audit substitute.

Metrics should be SMART (specific, measurable, achievable, relevant, time-bound) and reported to management; trends across periods are more informative than single-point measurements.