ISO/IEC 27002 Manager common mistakes
ISO/IEC 27002 Manager · Understand the traps and how to avoid them.
Treating ISO/IEC 27002 as a certifiable management system standard and answering questions as if organizations can be 'certified to 27002', rather than recognizing it as a guidance catalogue of controls that supports ISO/IEC 27001.
Candidates often come from an IT audit background where 27001 certification is familiar and assume 27002 sits at the same level; the two numbers look like a pair, and marketing material frequently conflates them.
What to do instead
Memorize the division of labour before studying controls: 27001 specifies requirements for an ISMS and is the certifiable standard; 27002 provides implementation guidance for controls referenced in 27001 Annex A. When a question asks about certification scope, auditability of requirements, or 'shall' language, the answer belongs to 27001; when it asks about how to implement or interpret a control, it belongs to 27002.
Answering control-selection questions by picking the 'strongest' or most technical control instead of applying the risk-based, context-driven logic of the standard.
Technical candidates default to preventive technical measures (firewalls, encryption, MFA) because those feel concrete, while 27002 guidance is explicitly proportionate to risk and organizational context, and often the correct answer is a governance, contractual, or physical control.
What to do instead
For every scenario, first identify the asset, the threat, and the risk level stated in the stem, then ask which control addresses that specific risk proportionately. Practise justifying why a technical control is not automatically correct when the risk is low or the exposure is contractual or physical. Read the stem for context clues such as 'small organization', 'third-party hosted', or 'low likelihood'.
Confusing the information security, cybersecurity, and privacy concepts as interchangeable, and mapping a privacy requirement to a security control (or vice versa) in scenario questions.
The three areas overlap heavily in day-to-day practice, and candidates rely on intuition rather than the distinct definitions and objectives set out in ISO/IEC 27000-series vocabulary and ISO/IEC 27002's structure.
What to do instead
Build a one-page comparison: information security (preservation of confidentiality, integrity, availability), cybersecurity (protection of networks, systems, and data in cyberspace), and privacy (protection of personally identifiable information and lawful processing). For each practice question, label the primary objective before choosing an answer, and note that privacy extends beyond security to consent, purpose limitation, and data subject rights.
Memorizing the 27002 control clause numbers and titles as a list while failing to place each control within its thematic clause (organizational, people, physical, technological).
Flashcard-style study rewards rote recall of titles, but exam questions describe a situation and expect the candidate to recognize the control theme and clause family, not recite a number.
What to do instead
Study by clause theme and build a mental map: organizational controls (policies, roles, supplier relationships, incident management), people controls (screening, terms of employment, awareness, disciplinary process), physical controls (perimeters, entry, equipment), and technological controls (access, cryptography, logging, malware, backup). For each control, write one sentence on the risk it addresses and one realistic scenario where it applies.
Selecting 'access control' or 'least privilege' as the answer for every identity-related scenario, including ones about privileged access, authentication, or access review, which are addressed by distinct controls.
Access control is a broad umbrella and candidates stop at the first plausible-sounding control rather than distinguishing access rights allocation, privileged access management, authentication information, and periodic access reviews.
What to do instead
Learn the access-control cluster as separate controls with separate purposes: allocation and revocation of access rights, management of privileged access, management of authentication information, and periodic review of access rights. Match the verb in the question (grant, review, revoke, authenticate, protect credentials) to the specific control rather than the umbrella term.
Treating awareness, training, and education as one interchangeable activity and picking the wrong one for a scenario about changing behaviour versus building skills versus developing expertise.
The terms sound synonymous in everyday speech, and candidates do not recall that the standard distinguishes awareness (attention and attitude), training (skills for the role), and education (broader understanding and expertise).
What to do instead
Anchor the distinction with examples: awareness campaigns address phishing vigilance and policy familiarity; training builds role-specific competence such as secure coding or incident handling; education develops deeper expertise such as security qualifications. When the stem mentions 'all staff, regularly, to keep security top of mind', choose awareness; when it mentions 'developers need to apply secure coding', choose training.
Answering incident management questions with 'detect and respond' actions only, skipping the preparation, reporting, assessment, and post-incident learning phases that the standard expects.
Candidates picture the dramatic middle of an incident and overlook the lifecycle, so they miss answers about responsibilities and procedures established in advance, consistent reporting channels, and lessons learned after closure.
What to do instead
Learn incident management as a lifecycle: planning and preparation with defined responsibilities and procedures; consistent reporting and logging through agreed channels; assessment and decision on classification and escalation; response including containment and recovery; and post-incident review feeding improvements. Read the stem for the phase indicated by keywords such as 'before', 'during', 'after', or 'who should be informed'.
Confusing supplier relationship controls with cloud-specific or outsourcing-specific controls, and choosing 'contractual agreements' for every third-party scenario regardless of whether the question is about due diligence, service delivery monitoring, or supply chain security.
Third-party risk is a large topic and candidates reduce it to 'put it in the contract', missing the distinct controls for information security in supplier relationships, monitoring and review of supplier services, and management of changes to supplier services.
What to do instead
Separate the supplier controls: agreeing information security requirements with suppliers, managing changes to supplier services and the supply chain, and monitoring and reviewing service delivery against agreements. Map question keywords ('before signing', 'ongoing performance', 'change of subcontractor') to the corresponding control, and remember that due diligence precedes contractual agreement.
Treating business continuity and backup as the same control and choosing 'take backups' for scenarios about maintaining operations during disruption or about testing continuity arrangements.
Backups are the most familiar resilience measure, so candidates default to them even when the question concerns continuity planning, redundancy of processing facilities, or exercising and testing continuity plans.
What to do instead
Distinguish the controls: information backup covers copies of information and restoration capability; ICT readiness for business continuity covers planning, implementing, and testing continuity arrangements including redundancy and recovery objectives. If the stem mentions 'continue operating', 'recovery time', or 'test the plan', choose the continuity control; if it mentions 'restore data' or 'backup copies', choose backup.
Ignoring the 'monitoring, measurement, analysis and evaluation' and 'internally audit' style questions because they feel like 27001 management-system content, and losing easy marks on how controls are verified.
Candidates mentally partition 27002 as pure control guidance and skip the parts of the standard that describe how to confirm controls operate effectively, so they cannot distinguish monitoring from auditing or from management review.
What to do instead
Study the evaluation layer deliberately: monitoring and measurement determines what is tracked and how; internal audit provides independent, systematic assessment against criteria; management review is a leadership-level evaluation of the ISMS. In scenario questions, match the actor ('independent function', 'process owner', 'top management') and the purpose ('ongoing tracking', 'conformance assessment', 'strategic decision') to the correct activity.