ISO/IEC 27002 Manager cheat sheet

Information security preserves confidentiality, integrity and availability (CIA); ISO/IEC 27000 defines these as the core properties the ISMS must protect.

Confidentiality means information is not disclosed to unauthorized persons, processes or entities; integrity means it is accurate, complete and protected against unauthorized modification; availability means it is accessible to authorized users when required.

ISO/IEC 27002:2022 is guidance for selecting and implementing controls from ISO/IEC 27001 Annex A; it is not a certifiable standard by itself and does not add requirements beyond 27001.

The 2022 revision of ISO/IEC 27002 restructures controls into four themes: organizational (37 controls), people (8), physical (14) and technological (34), totaling 93 controls.

Risk is the effect of uncertainty on objectives, expressed as a combination of likelihood of an event and its consequence; risk treatment options are modify, retain, avoid and share.

Defense in depth layers preventive, detective and corrective controls so that failure of one layer does not lead to a single point of compromise.

The ISMS follows Plan-Do-Check-Act: establish (Plan), implement and operate (Do), monitor and review (Check), maintain and improve (Act).

Cybersecurity extends information security to networked systems and the cyberspace environment, addressing threats to networks, systems and users across connected infrastructure.

Privacy protection under ISO/IEC 27701 extends the ISMS to personally identifiable information (PII), adding controller and processor-specific controls to the 27002 baseline.

Annex A 5 (organizational) covers policies, roles, segregation of duties, threat intelligence, supplier relationships, incident management, business continuity and compliance; A.5.7 is threat intelligence and A.5.23 is cloud service security.

Annex A 6 (people) covers screening (A.6.1), terms of employment (A.6.2), awareness and training (A.6.3), disciplinary process (A.6.4), remote working (A.6.5) and event reporting (A.6.6).

Annex A 7 (physical) covers physical perimeter (A.7.1), entry (A.7.2), offices and facilities (A.7.4), protection against physical and environmental threats (A.7.5) and secure disposal or reuse of equipment (A.7.14).

Annex A 8 (technological) covers access control (A.8.2-A.8.5), cryptography (A.8.24), logging (A.8.15), backup (A.8.13), malware (A.8.7), vulnerability management (A.8.8) and secure development (A.8.25-A.8.31).

Access control follows least privilege and need-to-know: A.8.2 privileged access rights, A.8.3 information access restriction, A.8.4 access to source code, A.8.5 secure authentication.

Cryptography controls: A.8.24 defines policy on use of cryptography including key management; keys must be protected throughout their lifecycle and cryptographic failures must be managed.

Logging and monitoring: A.8.15 requires event logs, A.8.16 monitoring activities and A.8.17 clock synchronization so logs across systems are correlatable.

Incident management: A.5.24 planning and preparation, A.5.25 assessment and decision, A.5.26 response, A.5.27 learning from incidents, with A.5.28 collection of evidence.

Supplier and cloud: A.5.19 information security in supplier relationships, A.5.20 addressing security within supplier agreements, A.5.22 monitoring and review, A.5.23 cloud services, A.8.30 outsourced development.

Control attributes in ISO/IEC 27002:2022 classify each control by control type (preventive, detective, corrective), information security properties (CIA), cybersecurity concepts, operational capabilities and security domains.

Business continuity: A.5.29 information security during disruption, A.5.30 ICT readiness for business continuity, A.8.13 information backup and A.8.14 redundancy of processing facilities.

Technical vulnerability management (A.8.8) requires timely identification of vulnerabilities, assessment of exposure and appropriate action; it is distinct from patch management alone.

Secure development: A.8.25 secure development life cycle, A.8.26 application security requirements, A.8.27 secure system architecture and engineering principles, A.8.28 secure coding, A.8.29 security testing in development and acceptance.

Data leakage prevention and data masking are addressed under A.8.12; information deletion under A.8.10 and data masking under A.8.11.

Threat intelligence (A.5.7) involves collecting and analyzing information about threats to inform controls; it is an organizational control, not a technological one.

Configuration management: A.8.9 configuration management, A.8.19 installation of software on operational systems, A.8.32 change management and A.8.31 separation of development, test and production environments.

Compliance: A.5.31 legal, statutory, regulatory and contractual requirements; A.5.34 privacy and protection of PII; A.5.35 independent review of information security; A.5.36 compliance with policies, rules and standards.

Risk assessment identifies assets, threats, vulnerabilities and existing controls, then estimates likelihood and impact to derive a risk level for treatment decisions.

Risk treatment residual risk is the risk remaining after controls are applied; management must accept residual risk explicitly and record it in the risk register.

The CIA triad is the basis for evaluating control effectiveness: a control is selected based on which property it protects and which threat it mitigates.

ISO/IEC 27001 requires a Statement of Applicability (SoA) that lists all 93 Annex A controls, justifies inclusion or exclusion, and records implementation status.

Privacy principles include lawfulness and fairness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.

PII is any information relating to an identified or identifiable natural person; pseudonymization reduces linkability but does not by itself make data anonymous.

Threat, vulnerability and risk are distinct: a threat is a potential cause of an incident, a vulnerability is a weakness that can be exploited, and risk is the potential for loss when a threat exploits a vulnerability.

Security awareness, education and training are people controls that reduce the likelihood of human-error-driven incidents; they complement, not replace, technical controls.

The 93 controls in ISO/IEC 27002:2022 replaced the 114 controls of the 2013 edition; 11 new controls were added, including threat intelligence, cloud services, data masking, monitoring, and secure coding.

New controls in 2022 include A.5.7 threat intelligence, A.5.23 cloud services, A.8.9 configuration management, A.8.10 information deletion, A.8.11 data masking, A.8.12 data leakage prevention, A.8.16 monitoring, A.8.23 web filtering, A.8.28 secure coding and A.5.30 ICT readiness.

Organizational controls (A.5) are largely policy and governance; technological controls (A.8) are largely technical enforcement; both are needed for a complete control set.

Access control lifecycle: provisioning, review, modification and revocation; A.8.2 requires restriction and management of privileged access rights and periodic review.

Supplier agreements (A.5.20) must address information security requirements, incident notification, right to audit and data protection obligations.

Incident response phases map to controls: preparation (A.5.24), detection and assessment (A.5.25), response (A.5.26), learning (A.5.27), evidence collection (A.5.28).