Framework · Last verified
ISO/IEC 27002
ISO/IEC 27002:2022 is the information security controls guidance standard; ISO assigns the certifiable requirements role to ISO/IEC 27001, not to it. ISO's own page separates the two roles: "While ISO/IEC 27001 outlines the requirements for an ISMS, ISO/IEC 27002 offers best practices and control objectives related to key cybersecurity aspects…". The current edition is the third, published February 2022.
- Class
- Framework
- Owner
- ISO/IEC (Joint Technical Committee ISO/IEC JTC 1)
- Last verified
What it is
The official title is "Information security, cybersecurity and privacy protection — Information security controls" (Edition 3, publication date 2022-02, status Published — ISO's own page, read in a browser on 7 September 2026).
It is guidance, not a certifiable management system standard: its own title names "Information security controls", and ISO's description assigns the requirements role to ISO/IEC 27001. A claim that an organisation is "ISO 27002 certified" has no basis in the pages read for this record.
The Dutch national catalogue (NEN) lists the 2022 edition at 152 pages, published 2022-02-01 — carried here as a catalogue fact with its source.
One correction this record deliberately encodes: the 2024 climate-action amendment belongs to ISO/IEC 27001, not to 27002 — the research round found no amendment listed on 27002's own page, so none is claimed.
Who owns it
ISO and IEC jointly, through ISO/IEC JTC 1; national standards bodies (NEN, EVS, BSI and others) publish mirror editions.
Who asks for it
Buyers and frameworks reach it through ISO/IEC 27001: 27001's Annex A controls are elaborated by this guidance, so 27002 is read alongside a 27001 project rather than demanded on its own in the sources read for this record.
Sources
- ISO — ISO/IEC 27002:2022 (standard page; opened via a real browser, automated clients get 403) ↗ — accessed
- NEN catalogue — ISO/IEC 27002:2022 (publication date and page count) ↗ — accessed
Last verified:
This page is for information only; it does not accredit, certify or endorse any organisation. Requirements and programs change — always confirm against the primary source linked above.