ISO 27002

1. 2026-09-11 High
   ISO/IEC 24383:2026 FDIS sets requirements for physical network security of customer premises ICT…

   IEC has released the Final Draft International Standard (FDIS) of ISO/IEC 24383:2026, available for purchase during its voting period (2026-09-11 to 2026-10-23), with the final publication …

   New document Deadline 2026-10-23 Action required

1. 2022-10-25 ISO/IEC 27001:2022 is published; its Annex A references the controls of ISO/IEC 27002:2022

1. 2022-02-15
   ISO/IEC 27002:2022 Major versionCurrent

   Third edition; the control set was restructured from 114 controls in 14 clauses to 93 controls in 4 clauses. source

   More

   • 11 controls are new, 24 were merged from existing controls and 58 were updated.
   • Each control now has attributes and a purpose; control objectives for groups of controls are no longer used.
2. 2015-11-06
   ISO/IEC 27002:2013/Cor 2:2015 Errata

   Technical Corrigendum 2 to the 2013 edition. source

3. 2014-09-18
   ISO/IEC 27002:2013/Cor 1:2014 Errata

   Technical Corrigendum 1 to the 2013 edition. source

4. 2013-09-25
   ISO/IEC 27002:2013 Major version

   Second edition, titled "Code of practice for information security controls". source

5. 2005-06-15
   ISO/IEC 27002:2005 Major version

   First edition under the 27002 number; technically identical to ISO/IEC 17799:2005. source

   More

   • ISO/IEC 17799:2005/Cor 1:2007 changed the reference number from 17799 to 27002.

Any organization that uses information security controls, in or outside an ISO/IEC 27001 ISMS. It is voluntary guidance.

Uses

Within an ISMS based on ISO/IEC 27001; for implementing controls based on internationally recognized best practices; for developing organization-specific security management guidelines. source

Content

A reference set of generic information security controls with implementation guidance. source

Link to ISO/IEC 27001

Annex A of ISO/IEC 27001:2022 references the information security controls in ISO/IEC 27002:2022, including each control's title and control text. source

Legal status

ISO standards are voluntary and contain no contractual, legal or statutory requirements; national laws take precedence. source

The controls are checked as part of ISO/IEC 27001 certification, where auditors must know them.

Through ISO/IEC 27001

Organizations compare the controls they need with the Annex A reference set taken from ISO/IEC 27002:2022 and record the result in a Statement of Applicability. source

Auditor knowledge

An ISO/IEC 27001 audit team as a whole must know all controls in ISO/IEC 27002:2022 and their implementation. source

A voluntary standard; it sets no contractual, legal or statutory requirements.

Legal force

ISO standards are voluntary and contain no contractual, legal or statutory requirements. source

1. Standard ISO/IEC 27002:2022 (catalogue entry; paid standard)
2. Guidance IAF MD 26:2023, section 2: changes in Annex A and in the ISO/IEC 27002:2022 control set

1. ISO 27001

   ISO/IEC 27001 holds the certifiable ISMS requirements; ISO/IEC 27002 gives guidance on the controls its Annex A lists.

2. ISO 27017

   ISO/IEC 27017 adds cloud-specific guidance and controls on top of ISO/IEC 27002.

3. ISO 27018

   ISO/IEC 27018 adds guidance for public cloud providers that process personal data on top of ISO/IEC 27002.

4. NIST SP 800-53

   NIST SP 800-53 is the US federal control catalogue with baselines; ISO/IEC 27002 is an international, voluntary control guidance set.

5. CIS Controls

   CIS Controls are a prioritized list of safeguards from the Center for Internet Security; ISO/IEC 27002 is the ISO/IEC control guidance behind ISO/IEC 27001 Annex A.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 14 September 2026. Subscribe to ISO 27002 (RSS)