What is ISO/IEC 27002? Controls, Themes and the Statement of Applicability

October 27, 2026•S.M. Waqas Imam

ISO/IEC 27002:2022 is an international guidance standard that helps organizations select, implement and manage information security controls. It contains 93 controls organized into four themes: Organizational, People, Physical and Technological.

The standard complements ISO/IEC 27001 by providing guidance on information security controls and their implementation. It is not a certification standard in itself: organizations certify against ISO/IEC 27001, and use ISO/IEC 27002 to understand how controls can be put into practice.

93controls in ISO/IEC 27002:2022

4control themes

1Statement of Applicability linking them to your risks

ISO/IEC 27002:2022 controls by theme

The 93 controls in ISO/IEC 27002:2022 are distributed across four themes:

Control theme	Number of controls	Primary focus
Organizational	37	Governance, policies, risk management, supplier security
People	8	Personnel responsibilities, awareness and employment practices
Physical	14	Facilities, equipment and physical protection
Technological	34	Technical security, access management, monitoring and secure development
Total	93

These figures describe the structure of ISO/IEC 27002:2022. They do not indicate how many controls every organization must implement. Control selection should reflect the organization's risks, requirements and circumstances. For a practical walk-through of the same control set, read How to comply with ISO/IEC 27001:2022 Annex A controls.

How ISO/IEC 27001 and ISO/IEC 27002 work together

ISO/IEC 27001 and ISO/IEC 27002 serve different but complementary purposes. ISO/IEC 27001 defines the ISMS requirements. ISO/IEC 27002 provides guidance on information security controls and their implementation.

ISO/IEC 27001

Defines ISMS requirements

Risk assessment and treatment requirements
Annex A control reference set
Statement of Applicability requirements

ISO/IEC 27002

Provides control guidance

Control purpose and implementation guidance
93 controls across four themes
Practical security measures

Risk-based control implementation

Select, justify, implement and review controls appropriate to the organization.

Organizations can use ISO/IEC 27002 to understand the controls referenced in ISO/IEC 27001 Annex A, evaluate their relevance and develop suitable implementation measures. The relationship can be summarized as follows:

ISO/IEC 27001: Establishes the requirements for the information security management system.
ISO/IEC 27002: Provides control guidance to support the selection and implementation of appropriate information security measures.
Risk assessment and treatment: Help determine which controls are necessary for the organization's circumstances. See risk assessment and risk treatment in ISO 27001.
Statement of Applicability: Documents control decisions, inclusion justifications, implementation status and exclusions, as required by ISO/IEC 27001. See Annex A and the Statement of Applicability.

From risk assessment to control implementation

Effective control implementation follows a connected process rather than treating the control list as a standalone checklist.

Risk assessmentIdentify information security risks and evaluate them against defined criteria.
Risk treatmentDetermine how identified risks will be addressed.
Control selectionIdentify suitable controls using ISO/IEC 27002 guidance, and consider applicable organizational, legal, regulatory, contractual and other requirements.
Statement of ApplicabilityDocument the necessary controls, reasons for inclusion, implementation status and justifications for exclusions.
ImplementationAssign responsibilities, establish procedures, deploy safeguards and retain appropriate evidence.
Monitoring and improvementEvaluate effectiveness, address deficiencies, and update risk treatment and control decisions when circumstances change.

This workflow helps maintain traceability between identified risks, selected controls and the actions taken to manage them. It is the same principle behind treating information security as an operating principle rather than an annual exercise.

Practical example: applying ISO/IEC 27002 guidance

Consider an organization that stores sensitive customer information in a cloud-based business application.

A risk assessment identifies the possibility of unauthorized access to customer records. The organization evaluates the potential consequences, existing safeguards and relevant obligations before deciding how to treat the risk.

ISO/IEC 27002 guidance can help the organization evaluate relevant measures, such as access restrictions, secure authentication, logging, monitoring and information security arrangements for cloud services.

The organization then documents its decisions, assigns control owners, establishes implementation procedures and determines how the effectiveness of the safeguards will be monitored.

The Statement of Applicability records the relevant control decisions, while the risk treatment documentation explains how the selected measures address the identified risk.

ISO/IEC 27002 guidance is most useful when applied alongside risk management, rather than used as an isolated list of controls.

Startups and SMEs facing this exact situation can read more in GDPR / ISO 27001 Compliance for Startups and SMEs in Industry 4.0.

Using ComplyEncrypt to manage the Statement of Applicability

A Statement of Applicability is easier to maintain when control information, risk decisions and implementation guidance are accessible within a connected workflow.

ComplyEncrypt provides a visually interactive Statement of Applicability linked with risk management, helping teams navigate control decisions and understand their implementation responsibilities.

Its SoA includes guidance informed by ISO/IEC 27002, along with brief procedures to help users understand how relevant controls may be implemented.

The workflow also distinguishes controls that are required by organizational, legal, contractual or risk-treatment obligations from controls that have been determined not to be applicable within the organization's context.

An important distinction

ISO/IEC 27002 does not classify controls universally as mandatory or optional. Applicability must be determined using the organization's actual requirements, risk treatment decisions and relevant ISO/IEC 27001 obligations. A control excluded from the SoA must have an appropriate justification where required.

By bringing control guidance and risk management together, ComplyEncrypt helps users connect the reasoning behind control selection with the practical work needed to implement and maintain the ISMS. This is also why a chatbot is not a compliance department: control decisions need structure, ownership and evidence, not just answers.

Conclusion

ISO/IEC 27002:2022 provides practical guidance for understanding and implementing information security controls. Its 93 controls cover organizational, people-related, physical and technological security considerations.

The value of the standard lies not simply in knowing the control titles, but in understanding how relevant controls address risks and how they can be implemented effectively.

A well-maintained Statement of Applicability supports this process by documenting control decisions and connecting them with risk treatment and implementation activities.

ComplyEncrypt's visually interactive SoA builds on this approach by providing ISO/IEC 27002-informed guidance, a link with risk management, and brief implementation procedures within a structured control workflow. The result is a more practical way to understand control applicability, maintain traceability and support continual improvement of the ISMS.

Build your ISO 27001 SoA with ComplyEncrypt

See what the ComplyEncrypt ISO 27001 framework includes, start with our guide What is ISO 27001?, or talk to our team.