ISMS and Initiation of ISO/IEC 27002 Control Implementation
Domain 2 tests how an ISO/IEC 27001 ISMS is established and how the 93 controls of ISO/IEC 27002:2022 are selected, justified and launched. Expect questions on the relationship between the two standards, the Statement of Applicability (SoA), risk treatment and the five control attributes.
ISMS backbone
27001 clauses 4-10 run: context, leadership, planning, support, operation, performance evaluation, improvement. Planning (6.1) requires an information security risk assessment, a risk treatment plan and an SoA. Clause 6.1.3 requires every Annex A control to be addressed: included, or excluded with a documented justification.
Selecting 27002 controls
27002:2022 is guidance, not a checklist. Controls sit in four themes: organizational (5.x, 37), people (6.x, 8), physical (7.x, 14), technological (8.x, 34). Annex A assigns each control five attributes used to filter and report coverage: control type (preventive, detective, corrective), information security properties (confidentiality, integrity, availability), cybersecurity concepts (identify, protect, detect, respond, recover), operational capabilities, and security domains (governance and ecosystem, protection, defence, resilience).
Initiation sequence
Confirm scope and interfaces, run a gap analysis against 27001 and candidate controls, perform risk assessment, choose treatments, record the SoA, then build an implementation plan with owners and dates.
Worked example
An insurer scopes its ISMS to the claims platform and its hosting provider. Reasoning: the scope must state boundaries and dependencies; outsourced hosting is not out of scope - A.5.23 (cloud services) and A.5.19-5.22 (supplier relationships) apply, and interfaces are documented. If A.8.11 data masking is excluded, the SoA must justify that by risk, not by preference.
Traps
Copying 27002 into the SoA without justification; treating excluded controls as automatically compliant; confusing risk assessment with risk treatment; assuming 27002 certification exists; ignoring attributes when reporting coverage.