ISO 27002: The Guide to Annex A Controls
ISO 27002 explains how to implement the Annex A controls that sit behind ISO 27001 certification. StartComply maps every control to risks, owners, evidence and audit tasks, so European teams can prove implementation instead of chasing screenshots before Stage 2.
Trusted by 100+ organisations across Europe
ISO 27001:2022 
ISO 27002 
NIS2 
DORA What you need to know about ISO 27002
- ISO 27002 is the implementation guidance for the 93 Annex A controls in ISO 27001:2022. It is not certifiable on its own, but auditors use it to judge whether controls are implemented properly.
- The 2022 revision replaced 114 controls with 93 controls organised into four themes: Organisational, People, Physical and Technological.
- The Statement of Applicability must explain which controls are applicable, which are excluded, and how every included control links to risk treatment and evidence.
- Continuous monitoring matters. Dated records, owners, review history and remediation evidence are what separate an operating ISMS from a paper exercise.
- StartComply keeps ISO 27002 controls, risk records, evidence and audit exports synchronised across ISO 27001, NIS2 and DORA obligations.
Last updated May 2026.
What Is ISO 27002?
ISO 27002 is the guidance standard that explains how to implement information security controls. ISO 27001 tells you what your Information Security Management System must achieve; ISO 27002 gives the practical guidance behind the control set in Annex A.
It is not an independent certificate. No certification body issues an ISO 27002 certificate. But every ISO 27001 auditor will test whether the controls in your Statement of Applicability are implemented in a way that satisfies the purpose and guidance behind each control.
For European teams, ISO 27002 also helps connect control implementation to wider obligations. A mature control framework supports ISO 27001 certification and strengthens your wider ISO 27001 compliance evidence. Control guidance becomes audit evidence when it is mapped to risks, owners, records and review cycles.
ISO 27002 is guidance, not certification. The certificate comes from ISO 27001. The implementation depth comes from ISO 27002.
ISO 27002 turns control lists into operating evidence.
Traceable controls with dated evidence
- Every applicable control linked to a risk and treatment decision
- Named control owner and review cadence
- Evidence showing the control exists and operates
- Monitoring records for technological and organisational controls
- Corrective action trail where a control fails or drifts
Audit reality: implementation guidance matters because Stage 2 auditors test whether controls work, not whether they are named in a policy.
Controls marked implemented without proof
- Statement of Applicability not aligned with the risk register
- Access reviews completed but not dated or signed off
- Supplier controls marked applicable with no review records
- Vulnerability scans collected but remediation not tracked
- New 2022 controls missing from legacy frameworks
The fix: keep controls, risks, owners, records and audit exports in one system of record.
The Four ISO 27002:2022 Control Themes
Organisational controls
Controls 5.1 to 5.37 cover governance, policies, roles, threat intelligence, project security and supplier relationships. These controls are where many organisations connect their ISO 27001 controls to practical operating evidence.
- Information security policies and roles
- Threat intelligence and project security
- Supplier relationship security
- Incident planning and continuity governance
People controls
Controls 6.1 to 6.8 cover screening, employment terms, awareness training, disciplinary processes, remote working and event reporting.
- Role-based awareness training
- Employment lifecycle security
- Remote working controls
- Security event reporting
Physical controls
Controls 7.1 to 7.13 cover secure areas, entry controls, offices, equipment and off-premises assets. They are still relevant for hybrid and cloud-first organisations.
- Physical access controls
- Secure areas and facilities
- Clear desk and screen procedures
- Off-site asset protection
Technological controls
Controls 8.1 to 8.34 cover endpoint devices, privileged access, authentication, malware protection, vulnerability management, logging, monitoring and secure coding.
- Access restriction and authentication
- Vulnerability and configuration management
- Monitoring and logging activities
- Data masking, DLP and secure coding
How to Use ISO 27002 in Your ISMS
Confirm applicable controls ISO 27002
Start with scope, assets and risk context. Your control set should reflect how your organisation operates, not a generic template.
Build the SoA ISO 27002
Create a complete Statement of Applicability with inclusion and exclusion rationale. Use your ISO 27001 documentation set to maintain the SoA, policies and records together.
Collect proof of operation ISO 27002
For every included control, collect dated evidence. The same evidence pack should support your ISO 27001 audit without emergency screenshot chasing.
Track control performance ISO 27002
Controls must be reviewed at planned intervals and after major changes. Monitoring records prove the ISMS is operating continuously.
Link back to risk ISO 27002
Use ISO 27005 risk guidance to trace controls back to risk assessment, treatment and improvement decisions.
ISO 27002:2022 at a glance
ISO 27002 Control Evidence Matrix
Use this matrix to turn each ISO 27002 control into evidence that a certification body can inspect.
Audit-ready control evidence means the control is justified, implemented, monitored and linked back to risk treatment.
Frequently Asked Questions About ISO 27002
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 is the certifiable management system standard. ISO 27002 is the implementation guidance for the Annex A controls that support that management system. You get certified against ISO 27001 through an accredited certification body, but you use ISO 27002 to implement controls correctly. For the full certification path, read the ISO 27001 certification guide.
How many controls are in ISO 27002:2022?
ISO 27002:2022 contains 93 controls, reduced from 114 in the 2013 version. The controls are now grouped into Organisational, People, Physical and Technological themes. The reduction consolidated overlap; it did not make the audit easier.
Is ISO 27002 certification available?
No. ISO 27002 is not a certifiable standard. Any provider claiming to issue ISO 27002 certification is misrepresenting the standard. The certificate comes from ISO 27001. ISO 27002 supports the implementation depth needed to pass that audit.
Do I need to implement all 93 controls?
No. You select controls based on risk assessment and justify any exclusions in the Statement of Applicability. Exclusions must be specific and evidenced. Your final cost and audit scope will depend on organisation size, ISMS boundaries and control complexity, as explained in the ISO 27001 certification cost guide.
How does ISO 27002 support NIS2 and DORA readiness?
Many ISO 27002 controls map directly to NIS2 Article 21 and DORA ICT risk management expectations, especially around access control, incident handling, supply chain security, cryptography and business continuity. One control evidence trail can support multiple compliance obligations when mapped correctly.
What are the new ISO 27002:2022 controls?
The 2022 revision added controls covering threat intelligence, cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. Legacy control frameworks should be checked against these gaps before the next audit.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
