Information security controls based on ISO/IEC 27002
This domain tests ISO/IEC 27002:2022 as a guidance standard: its 93 controls grouped into four themes, the five attributes used to tag them, and how a candidate should reason about selecting and justifying controls rather than reciting a checklist.
Structure of the control set
Each control has a title, a control statement, a purpose, guidance and other information. The themes are organizational (5.1–5.37, 37 controls), people (6.1–6.8, 8 controls), physical (7.1–7.14, 14 controls) and technological (8.1–8.34, 34 controls). The same 93 controls form Annex A of ISO/IEC 27001:2022, where they become requirements only when declared applicable in the Statement of Applicability.
The five attributes
Control type (preventive, detective, corrective); information security properties (confidentiality, integrity, availability); cybersecurity concepts (identify, protect, detect, respond, recover, per ISO/IEC TS 27110); operational capabilities; and security domains (governance and ecosystem, protection, defence, resilience). Attributes support sorting and coverage analysis, and a single control can carry several of them.
New and restructured controls
The 2022 revision added 11 controls, including 5.7 threat intelligence, 5.23 information security for use of cloud services, 5.30 ICT readiness for business continuity, 7.4 physical security monitoring, 8.9 configuration management, 8.10 information deletion, 8.11 data masking, 8.12 data leakage prevention, 8.16 monitoring activities, 8.23 web filtering and 8.28 secure coding. The 114 controls of the 2013 Annex A were merged and restructured into the current 93.
Worked example
A sales team handling customer PII works from home. Risk-based selection: 6.7 remote working and 7.9 security of assets off-premises (people and physical themes); 8.1 user endpoint devices, 8.5 secure authentication and 8.12 data leakage prevention (technological); 5.34 privacy and protection of PII (organizational). Each is justified in the Statement of Applicability, and the candidate should note that 5.34 is organizational, not technological.
Traps that cost marks
- Treating 27002 as a mandatory checklist or as certifiable; only 27001 is certifiable.
- Omitting the justification for inclusion or exclusion in the Statement of Applicability.
- Miscategorising controls by theme (8.1 is technological; 7.9 is physical).
- Assuming one attribute per control.